Britain’s National Crime Agency (NCA) has been told to urgently overhaul an IT estate so dysfunctional that officers say they are fighting serious organised crime despite the technology rather than because of it.

A new report by HM Inspectorate of Constabulary and Fire & Rescue Services (HMICFRS) has delivered a bruising verdict on the National Crime Agency’s tech, concluding that the systems underpinning Britain’s fight against organised crime are no longer up to the job.

The criticism lands despite inspectors otherwise finding much to like. The NCA was graded “Good” in several operational areas, including tackling serious and organised crime and working with partners. But throughout the report, inspectors repeatedly return to technology as a fundamental weakness running through the entire organisation.

“The NCA’s IT infrastructure isn’t fit for purpose,” the report states. Inspectors backed that assessment with a long list of examples, from officers manually re-entering data and sharing information by hand to teams relying on spreadsheets and other workarounds due to a lack of confidence in official systems.

According to the report, around 70 percent of critical IT incidents each month are linked to that technical debt, the result of years spent prioritising short-term fixes over long-term modernisation.

Officers told inspectors they did not trust the agency’s systems, while others described technology as a major drag on productivity. One interviewee summed up the mood: “IT is a blocker; we achieve in spite of it.”

Another was even less flattering. “When I started in policing 15 to 20 years ago, I had better technology than I do in the NCA.”

The report paints a picture familiar to anyone who has worked in a large public sector IT environment. Officers told inspectors they routinely enter the same information multiple times, rely on manual processes, and manually transfer data to external partners. Some said the agency lacks even a basic personnel directory, making it difficult to find the right colleague when they need help.

While the NCA operates a corporate system called ATLAS CM, inspectors heard that officers are using as many as 50 different case management methods across the agency, including spreadsheets and other manual workarounds, often due to a lack of confidence in the official platform.

The agency’s security architecture has also produced its own headaches. Because data sits across multiple government security classifications, many officers reportedly require at least two laptops to do their jobs. Inspectors spoke to some staff who were using four separate machines and said they witnessed the resulting inefficiencies first-hand.

In a separate HMICFRS inspection published last year, inspectors found the agency was still relying on around 260 legacy IT systems more than a decade after beginning a project to modernise IT, with technical debt consuming roughly 80 percent of entire IT budget.

Most businesses believe they are well-prepared to face cyberattacks, but the number of successful breaches in the last year alone paints a different picture.

Last week, NordLayer released a new report, called “Why Browser Security Can’t Wait: Web-based Threat Report 2026.” In it, the company states that while 73% of organisations claim to be prepared for web-based attacks and are confident in their solutions, 82% experienced some form of web-based attack.

The paper is based on an analysis of 504 “highest rated and most reviewed work applications”, an analysis of data stolen from various info-stealers, and a survey of 405 US cybersecurity and IT professionals.

NordLayer stresses that coverage is “modest and uneven”, with data loss prevention tools (DLP) leading at just 53%, followed by other security controls. Nearly all IT professionals reported that their organisations are concerned about web-based threats (98%), and most expect escalation. In fact, 81% expect greater sophistication and 73% believe there will be more incidents in the coming years.

“There’s a clear gap between recognising the threat and knowing how to address it,” says Buinovskis. “Concern is high, but awareness of which controls actually solve browser-specific risks is low. Much of the initial confidence most likely comes from having general security controls in place, yet they rarely adequately cover risks in the browser.”

The researchers also stressed that 100% of the tested applications were browser-accessible, and almost four in five (78.8%) were browser-only. At the same time, malware was able to harvest 1.8 million credentials and 68.8 billion cookies last year.

“Hackers don’t hack anymore, they just log in,” says Buinovskis. “Stolen cookies and credentials grant immediate access without raising alarm bells — a login looks legitimate. It’s low risk, high reward, and as reliance on web-based SaaS grows, so does the value of stolen data. Attackers will keep exploiting this until organisations secure the browser as a critical boundary.”

Azul has published a new whitepaper warning organisations that running Oracle Java in production without a paid subscription carries serious financial and compliance risks.

The whitepaper, titled “Oracle Java Uncovered: What Free Java Users Need to Know Now,” comes as 73% of organisations report having been audited in the past three years.

Under Oracle’s Java SE Universal Subscription model, licensing costs are calculated based on total employee count, regardless of actual Java usage across the organisation.

A single unlicensed instance can trigger a demand to license the entire organisation, often accompanied by multi-year back-usage fees charged at list price.

That exposure extends beyond current employees, with audits potentially requiring organisations to license every contractor and part-time worker in addition to full-time staff.

The whitepaper outlines four paths forward for organisations currently running Oracle Java without a paid license, giving decision-makers a structured framework for evaluating their options.

Azul also cautions that switching to unsupported OpenJDK is not a straightforward fix, as it may not protect against back-usage fees tied to historical downloads of Oracle Java.

Unsupported OpenJDK also introduces its own risks, including patch stability concerns and regulatory exposure under compliance frameworks such as PCI-DSS 4.0 and DORA.

For organisations considering migration, Azul notes that OpenJDK is fully interchangeable with Oracle Java and requires no code changes or re-architecture to implement.

Commercially supported OpenJDK providers offer migration methodology, automated tooling, and expertise designed to reduce the time and resources required for transition.

Azul describes itself as the trusted leader in enterprise Java for the AI and cloud-first world, with its platform powering mission-critical systems for 36% of the Fortune 100.

The company also counts 50% of the Forbes Top Ten World’s Most Valuable Brands and the world’s top 10 financial trading companies among its customers.

The full whitepaper is available for download at azul.com/oracle-java-uncovered for organisations seeking to assess their current exposure and evaluate next steps.

Zendesk has rethought service pricing in an AI-first era beyond the evolution from seat-based to token-based pricing – the company now commits to outcome-based pricing marking one of the most important commercial shifts in the enterprise AI market.

Announced during the company’s annual Relate conference, the new model charges customers only when its AI systems have successfully revolved support interactions.

The company said every resolution would be independently verified with its own dedicated AI evaluation model, meaning that low-value exchanges would be excluded from billing.

The pioneering move reflects growing pressure across the AI industry to prove tangible business value rather than simply showcasing model capabilities for high and often wasted costs. With organisations now becoming more cautious about AI spend, vendors are increasingly being asked to demonstrate measurable ROI instead of charging for access alone, and Zendesk’s shift in pricing model holds the company accountable to pass on ROI to customers.

However, what this means in terms of revenue is less clear. For years, SaaS companies have largely relied on predictable subscription pricing tied to the number of users or licenses.

Zendesk’s approach effectively treats AI agents as digital workers whose compensation depends on measurable outcome, rather than availability. For Zendesk’s customers, it means they’ll only pay when meaningful work is completed.

As Shashi Upadhyay, President of Product, Engineering, and AI, put it in an interview at the event: “Stop thinking of agents as software… start thinking of them as a unit of labour.”

This marks the first time that a company like Zendesk could risk incurring costs without being able to recuperate them from clients, and it marks a major turning point for revenue models in general. The implications could extend far beyond customer service, as companies are expected to experiment with pricing tied to sales conversions, resolved tickets, completed workflows, productivity improvements and other outcomes.

This new strategy also reflects the growing competition within enterprise AI – looking ahead, pricing innovation may become just as important as model performance in acquiring and retaining customers.

So while Zendesk may be among the first to implement such pricing at scale, it offers a glimpse into how AI software could likely be commercialised in the future.

Workers are struggling to understand how to best use AI tools for their daily tasks due to a widening disconnect between employers and their employees, new research has claimed.

A new study from Mitel found that AI tools are often misaligned with how employees actually work, leading to widespread frustration.

This is leading many workers to bring in their own familiar tools from outside of work, potentially opening up their organisation to security threats and other risks.

The study found 71% of workers admitting to have used non-approved communication tools for work-related purposes, increasing the risk of the likes of data exposure, compliance breaches, cybersecurity threats, and a loss of visibility and control.

A similar proportion (71%) said they felt pressured to just “make it work” with tools not designed for their needs, showing the apparent disconnect or disinterest from senior management.

Overall, while just over half (51%) of workers said they regularly use AI tools, only 37% reported feeling very comfortable using them in their day-to-day work – with 70% saying they felt their organisation does not adequately support AI use.

“Organisations are making significant investments in AI, communication infrastructure, and modernisation,” said Eric Hanson, CMO at Mitel. “Yet more than half of employees report that these tools fall short at the moments that matter most.

“The challenge is not a lack of technology, but a lack of alignment with the realities of work. In fast-moving, high-pressure, and increasingly mobile environments, communication must be immediate, reliable and context-appropriate — or it risks breaking down precisely when it is needed most.”

“Closing the experience gap is now essential to reclaiming control and ensuring that communication investments translate into real-world performance and impact.”

The UK’s Competition and Markets Authority (CMA) is taking a closer look at Microsoft’s business software empire, launching a strategic market status investigation into the company’s ecosystem.

The probe, which is the fourth since the UK’s digital markets competition regime came into force last year, will determine whether Microsoft should be designated as having strategic market status, which would allow the CMA to implement interventions to support competition.

In March, the CMA announced that the investigation was coming. The regulator was concerned that Microsoft’s software licensing practices were reducing competition in the cloud.

In the most recent announcement, the CMA said it had “heard that UK customers may not always be able to effectively combine software from Microsoft with that of other providers, limiting their ability to get access to the best products at the most competitive prices.”

Microsoft is no stranger to regulatory friction. In 2025, it described calls from AWS and Google for the UK competition regulator to “intervene and constrain the price” it charges customers to run wares on those rivals’ cloud platforms as “extraordinary and unprecedented.”

Two year prior, Google branded Microsoft’s cloud software licensing a “tax” paid by customers as a penalty for not running Microsoft software on Azure infrastructure. It claims that Microsoft charges up to four times more, for example, to run Windows Server on GCP. AWS has previously moaned about this too.

As well as assessing whether Microsoft is using its position to limit customer choice, the CMA investigation “includes looking at how AI competitors are able to integrate with Microsoft’s business software, giving customers access to AI software across suppliers to best suit their needs.”

Microsoft is pushing Copilot AI into as many Microsoft 365 subscriptions as it can, even creating a new tier, E7, aimed specifically at AI services.

In a statement, Nicky Stewart, senior advisor to the Open Cloud Coalition – a trade association Microsoft previously dismissed as a Google lobby group – said:

“This investigation needs to be both rapid and conclusive. It must address Microsoft’s unfair licensing practices once and for all, giving the UK cloud market a level playing field and the confidence to innovate and invest for the long term.”

Readers should not expect results anytime soon. It took 21 months for the CMA to publish the results of an investigation into the UK cloud services market, in which it said Microsoft and AWS were using their dominance to harm UK cloud customers. It claimed Microsoft, for example, could have charged UK enterprise customers £500 million more annually to run its wares in AWS and Google clouds than they’d have paid to run them in Azure.

A key concern from that investigation – whether Microsoft’s software licensing practices were reducing competition in cloud services – has informed this one.

This latest inquiry must be completed within nine months, and a decision on designating Microsoft with SMS is scheduled to be reached by February 2027.

For its part, a Microsoft spokesperson said “We are committed to working quickly and constructively with the CMA to facilitate its review of the business software market.”

The investigation will be wide-ranging, encompassing productivity applications, operating systems, databases, and security software.

Sarah Cardell, Chief Executive of the CMA, said, “Our aim is to understand how these markets are developing, Microsoft’s position within them and to consider what, if any, targeted action may be needed to ensure UK organisations can benefit from choice, innovation and competitive prices.”

Authorities in the US, Europe, Brazil, South Africa and Japan are also closely monitoring Microsoft’s licensing policies.

Organisations that decide to reduce their VMware footprints, or quit entirely, will emerge with more complex and less capable infrastructure.

That’s the view of Paul Delory, a research vice president with analyst firm Gartner, who told the company’s IT Infrastructure, Operations & Cloud Strategies Conference in Sydney that there is no technical reason for VMware users to adopt a rival hypervisor, and that no vendor offers a one-for-one replacement for the virtualisation pioneer’s flagship Cloud Foundation (VCF) suite.

But Delory said Broadcom’s licensing policies, which see it only sell VCF, mean VMware users’ licensing bills typically rise by 300 to 400 percent. Broadcom argues that the full-stack private clouds VCF makes it possible to build are so efficient that VCF quickly pays for itself.

The analyst told the conference he thinks those contemplating a move off VMware will do better if they instead focus on application modernisation. But he said Broadcom’s price changes, and the prospect the company might hike prices again in future, mean many VMware users will look elsewhere.

Those who do, he warned, will end up with more complex infrastructure for two reasons.

One is that few organisations will be able to quit VMware entirely, as they run applications with dependencies that aren’t easy or economical to unwind. Reducing or eliminating a VMware rig therefore means adopting multiple replacements, which creates more infrastructure to manage and therefore extra complexity.

The other is that no rival hypervisor can match the efficiency or VM density possible when using VMware’s products, so moving means acquiring more hardware.

Delory said the best alternatives to VMware are the public cloud, or HCI vendors – these days that acronym denotes both hyperconverged infrastructure and hybrid cloud infrastructure.

The analyst warned that HCI vendors, with the exception of Nutanix, have weak migration tools that will leave users needing to create bespoke migration automations using “Ansible and a Rube Goldberg machine.”

Public clouds, he said, will welcome customers who move 1,000 or more VMs with free migration services.

He recommended against considering OpenStack, which he said remains “too big, too complex, and has too many moving parts for the typical IT shop to handle effectively.”

Delory also warned VMware users that migration projects are significant engineering undertakings that require extensive assessment of every application in a fleet to determine its best destination, and the work required to get it there.

He reminded VMware users that not every workload is certified to run under non-VMware hypervisors, and that some vendors now offer cloud-native versions of their wares and therefore offer an easier on-ramp to containerised applications.

Delory advised exploring those options, and not making architectural decisions that mean you can’t consider moving off VMware.

“VMware is betting that you can’t move off and they can jack the price way up,” he said. “That may be a good bet. But don’t make it easy.”

The analyst finished his talk by predicting most users will minimise their VMware footprints, rather than eliminating them, and restated Gartner’s prediction that 35 percent of workloads currently running under VMware will operate on a different platform by 2028.