The Exchange Daily

DeepSeek seismic shock and the $600 billion AI infrastructure pivot The “scaling law” of AI—the idea that more compute always equals better results—is being challenged. Chinese lab DeepSeek has demonstrated that high-performance models can be trained and run with significantly higher efficiency than previously thought. This forces a reassessment of massive AI capital expenditures and highlights th...

Microsoft launches Agentic Framework for Azure SQL Microsoft is moving to automate the database administration layer with its new Agentic Framework. The system allows AI agents to optimize queries and manage schemas autonomously. For IT leaders, this signals a shift from manual execution to policy-driven governance. Sources: https://www.google.com/search?q=https://azure.microsoft.com/en-us/blog/an...

AWS Innovation Deadline Checks the Shift to Production The submission window for the AWS Global 10,000 AIdeas Competition closes today. This milestone serves as a broader industry signal that the initial wave of “generative AI exploration” is maturing into a phase of required execution. Organizations should use this date not just to submit entries, but to evaluate their internal portfolios, moving...

CISA mandates remediation for active Windows “DWM” exploit (CVE-2026-20805) CISA has added a known exploited vulnerability in the Windows Desktop Window Manager to the KEV catalog, setting a federal remediation deadline of February 3. For enterprise CISOs, this is a non-negotiable signal to prioritize this patch, as active exploitation of core OS components represents a high-risk vector for unauth...

Parloa raises $350M to scale enterprise AI agents. Enterprise voice agents are crossing the line from experimentation to core platform investment. For IT and CX leaders, the operational bar is no longer “can it talk,” it’s whether the system can authenticate, escalate, log, and comply across regulated workflows. Treat this like critical business infrastructure with strong governance, audit trails,...

Pentagon AI Acceleration Strategy: execution speed, vendor posture, and governance risk. The Department of War released an AI Acceleration Strategy built around seven “Pace-Setting Projects,” designed to force measurable outcomes with single accountable leaders. The plan explicitly pushes department-wide access to frontier generative models, and it treats data, infrastructure, and policy as warfig...

FedRAMP tees up Authorization Act implementation with a NPRM playbook and six new RFCs. FedRAMP is moving quickly from concepts into rulemaking posture. The new blog post frames what the Authorization Act could mean in practice and pairs that framing with six Requests For Comment. The immediate value for leaders is clarity on where compliance mechanics might change first, including reporting expec...

Anthropic reliability watch as Claude posts back-to-back incident entries Anthropic logged two incidents in two days for its Claude models, each showing elevated error rates and delays in resolution. Even after a “resolved” status, CIOs should confirm application-level stability and data reconciliation for critical workflows. Sources: https://status.claude.com Google Vertex AI Agent Engine billing...

NIST Opens Public Input Window on AI Agent Security The National Institute of Standards and Technology’s Center for AI Standards and Innovation (CAISI) has issued a request for information (RFI) seeking public input on securing artificial intelligence agents. The sixty-day comment window allows stakeholders—developers, deployers, security researchers, and federal agencies—to shape NIST’s guidance...

Build data analytics agents faster with BigQuery’s fully managed, remote MCP server Google is pushing a practical pattern for agentic analytics by standardizing how AI applications connect to BigQuery through a managed remote MCP server. The value for enterprises is faster build cycles plus clearer governance controls, because the model-to-data connection becomes a managed interface instead of bes...

Microsoft’s Fabric move signals autonomous data engineering as the new default Microsoft’s acquisition of Osmos is a clear signal that AI-driven automation is becoming a default feature in enterprise data platforms. The upside is speed and scale, especially for teams drowning in pipeline operations and repetitive engineering work. The risk is governance drift, because autonomous behavior without t...

Monday AI Market Maker: Vibranium Labs raises $4.6M seed for Vibe AI Vibranium Labs is positioning Vibe AI as a 24/7 “AI incident engineer,” which signals that the market is aiming AI directly at operational toil and on-call fatigue. For CIOs and engineering leaders, the core question is how safely these systems integrate into paging, ticketing, and runbook execution without introducing new failur...

Consolidated Cyber Risk Stack: KEV Deadlines + OSCAL Draft + NICE Workforce Update Today’s cyber segment is about execution, not anxiety. When exploited vulnerabilities come with a due date, your job becomes simple: reduce exposure fast and document exceptions clearly. NIST’s OSCAL draft work is a reminder that compliance evidence is moving toward machine-readable structures and automation. The NI...

Just a quick reminder, The Exchange Daily is still free but will require you to subscribe at tie.metora.solutions. If you want more than Daily updates, the Exchange Weekly is your deep dive but requires a paid subscription. The end of year sale has been extended through the end of next week. So, if you enjoy both the Exchange Daily newscast and the Exchange Weekly Indepth Newsletter, trade a singl...

CISA KEV adds MongoDB CVE-2025-14847, and the deadline forces real patch governance. CISA’s Known Exploited Vulnerabilities process is a forcing function because it translates “this is exploited” into a date-driven executive expectation. In this case, the CVE is tied to MongoDB, which many organizations treat as core infrastructure and sometimes forget to treat as part of the externally abused att...

CISA KEV flags MongoDB Server CVE-2025-14847 as exploited. MongoDB operators are getting a clear signal to prioritize mitigation for CVE-2025-14847, because it is referenced as added to the exploited catalog through the NVD record. This is a governance moment where asset visibility and change windows matter as much as the patch itself. If you support data platforms, the operational goal is to redu...

Government IT moves faster than your inbox. By the time you’ve cleared morning emails, cleared security, and grabbed coffee, three agencies have issued new guidance, CISA added two vulnerabilities to the KEV catalog, and a major contractor announced a cloud partnership that changes your procurement landscape. You need to know what happened before your first meeting, not by reading a dozen websites...

Federal Register: HHS RFI on accelerating adoption and use of AI in clinical care. A new Request for Information in the Federal Register signals that federal health leaders want faster, more consistent AI adoption in clinical care. The policy direction matters because it will influence how clinical AI is evaluated, procured, and operationalized, including expectations for safety and accountability...

OpenAI releases GPT-5.2-Codex to push agentic coding deeper into enterprise delivery. OpenAI introduced GPT-5.2-Codex as a GPT-5.2 variant optimized for agentic software engineering workflows and defensive cybersecurity. For IT leaders, the signal is not just faster code, but a faster feedback loop that can change how teams refactor, migrate, and maintain systems. The operational risk is governanc...

Technology Modernization Fund cliff and the scramble to reauthorize. The Technology Modernization Fund problem isn’t theoretical. When a revolving modernization vehicle can’t approve new investments, it turns modernization planning into a stop-and-go exercise that burns time and increases delivery risk. For CIOs and budget owners, the immediate value is clarity. You want a decision list for what p...

Our Top Stories FAA air traffic control modernization moves into integration-led delivery The FAA is advancing a major modernization push for the air traffic control ecosystem, with a prime integrator approach that makes delivery integration the core accountability. For federal IT leaders, this is a live example of how to run a multi-year modernization program where safety and uptime constraints m...

CISA updates KEV with new exploited vulnerabilities that change patch priority. CISA added new entries to the Known Exploited Vulnerabilities Catalog, and that should move these items to the top of your vulnerability management queue. When KEV changes, the story is not the list itself, it is what it does to patch order, emergency change control, and exception handling for systems that cannot be up...

Monday AI Market Maker: PolyAI raises $86M Series D to scale enterprise voice agents. PolyAI’s new funding round is another indicator that enterprises are treating conversational voice systems as a core customer experience platform, not a novelty feature. That shift matters because voice agents have to operate under real service levels, integrate cleanly with customer records, and hand off to huma...

White House AI preemption order and OMB procurement memo tighten the policy and buying environment A new White House executive order sets a federal posture that favors a minimally burdensome national framework for AI while directing near-term actions designed to challenge or constrain certain state AI laws. It creates an AI Litigation Task Force, sets a Commerce timeline to evaluate state laws, an...

Agentic AI Foundation tries to become the standard plumbing for enterprise AI agents The new Agentic AI Foundation under the Linux Foundation is a clear signal that agentic AI is moving from scattered pilots into shared infrastructure. By giving Model Context Protocol, AGENTS.md, and related efforts a neutral home, the foundation is trying to turn emerging patterns for tools and orchestration into...