News Feed

The Key Differences Between a Data Breach and a Data Leak

~ Reporter ~ Leave a comment

In today’s increasingly digital world, concerns about the safety and security of personal and corporate data are paramount. With high-profile incidents in the media, terms like “data breach” and “data leak” are often used interchangeably. However, there are significant differences between the two, each with unique implications for businesses and individuals. Understanding these differences is crucial for responding effectively to these incidents and protecting sensitive information.

What is a Data Breach?

A data breach refers to an intentional or unintentional incident where unauthorized individuals or entities gain access to sensitive or confidential data. The key aspect of a data breach is that it involves malicious or unauthorized access to protected data. This can happen in a variety of ways, such as through hacking, phishing attacks, or the exploitation of vulnerabilities in a system.

Examples of data breaches include:

•    Hackers gaining access to a company’s database and stealing sensitive customer data.
•    A company insider improperly accessing or misusing confidential information.
•    Ransomware attacks where data is encrypted and held hostage until a ransom is paid.

Data breaches can involve anything from email addresses to financial records, healthcare data, or intellectual property. Once the breach has occurred, the stolen or exposed data can be used for malicious purposes, such as identity theft, fraud, or even corporate espionage. Due to the intentional nature of the access, data breaches often have legal consequences, including fines, lawsuits, and reputational damage.

Key Characteristics of a Data Breach:

•    Unauthorized access to data, often by cybercriminals or insiders.
•    Malicious intent or exploitation of vulnerabilities.
•    Often results in stolen data being used for illegal activities.
•    Affected parties are often notified because of legal obligations.

What is a Data Leak?

A data leak, on the other hand, typically occurs when data is accidentally exposed or unintentionally made accessible to the public or unauthorized individuals. Unlike a data breach, there is usually no malicious intent behind a leak. The exposed data may have been left unprotected due to poor security practices or simple human error.

Examples of data leaks include:

•    A cloud server misconfiguration that makes sensitive files publicly accessible.
•    Employees accidentally emailing confidential documents to the wrong recipient.
•    A company’s website that inadvertently exposes user data due to coding errors or security flaws.

While data leaks do not involve the malicious theft of data, they can still have serious consequences. Exposed data can be accessed by anyone, including criminals, competitors, or hackers. In some cases, the leak may go unnoticed for an extended period of time, leaving the exposed data vulnerable to misuse.

Key Characteristics of a Data Leak:
•    Data is exposed due to human error or poor security practices.
•    There is no malicious intent behind the exposure.
•    Affected data is often accessible by anyone with the right access.
•    The exposed data may be accidentally found, without any criminal action.

Key Differences Between a Data Breach and a Data Leak

While both incidents result in the exposure of sensitive data, there are important distinctions between a data breach and a data leak:

1. Intent:

@   A data breach involves malicious intent or unauthorized access by cybercriminals or insiders.

#    A data leak is typically caused by human error or a lack of proper security protocols.

2. Cause:

@    A data breach is the result of deliberate actions, such as hacking or exploitation of system vulnerabilities.

#    A data leak usually occurs because of poor security practices, like leaving files publicly accessible or making inadvertent mistakes.

3. Consequences:

@    A data breach often involves the stolen data being used for fraudulent or malicious activities, such as identity theft, blackmail, or financial fraud.

#  A data leak may expose data, but typically there is no immediate malicious use, though it can still lead to reputational damage or legal action.

4. Discovery:

#  A data breach often takes longer to detect, as cybercriminals may cover their tracks or continue accessing the system without detection.

# A data leak is usually noticed sooner because it is typically accidental and can be easily accessed by anyone.

5.Legal Ramifications:

# A data breach often requires immediate notification to affected individuals, regulatory bodies, and possibly legal consequences for the organization responsible.

# A data leak might not involve the same level of legal responsibility if it’s due to negligence, though regulations like GDPR require organizations to address such issues.

Why Understanding the Difference Matters

For businesses, the distinction between a data breach and a data leak is crucial for determining their response strategies, liability, and the appropriate measures to take to prevent further exposure. Data breach protocols typically include immediate investigation, legal notifications, public disclosures, and credit monitoring for affected individuals. On the other hand, while data leaks may still require corrective actions, the primary focus is often on improving security measures and addressing any vulnerabilities.

For consumers, understanding the difference can help them better gauge the risk and potential impact of a data exposure incident. Whether it’s a breach or a leak, taking immediate steps to protect personal information, such as changing passwords, monitoring accounts, and staying informed, is essential.

Final Thoughts

Though the terms “data breach” and “data leak” are often used interchangeably, they represent distinct types of incidents with different causes, consequences, and responses. While data breaches involve deliberate criminal activity aimed at stealing sensitive information, data leaks typically result from accidental exposures or poor security practices. Both can have serious implications for privacy, security, and compliance, making it crucial for organizations to maintain robust cybersecurity measures and data protection protocols to safeguard sensitive information.

By understanding these differences, individuals and businesses can take appropriate steps to protect their data and respond effectively in the event of an incident.

The post The Key Differences Between a Data Breach and a Data Leak first appeared on Cybersecurity Insiders.

The post The Key Differences Between a Data Breach and a Data Leak appeared first on Cybersecurity Insiders.

from Cybersecurity Insiders https://ift.tt/wMayxCt
via IFTTT

Hackers breach email systems of OCC to gather intelligence from emails

~ Reporter ~ Leave a comment

In what has become a significant and concerning information security incident, the Office of the Comptroller of the Currency (OCC), a key branch of the United States Treasury Department tasked with overseeing currency transactions within the nation’s banking system, has officially disclosed a serious breach involving its email systems. In a formal statement released recently, the OCC confirmed that it had notified Congress of the incident, which took place earlier this year in February.

The breach, which remains under investigation, involved an unknown malicious actor who successfully infiltrated the OCC’s email systems. According to the OCC, the cybercriminal(s) gained unauthorized access and potentially stole sensitive information linked to over 160,000 employees of the agency. The OCC’s statement underscored the gravity of the breach, which raises serious concerns about the security of sensitive governmental and financial data.

Cybersecurity Insiders have since learned that the intrusion into the OCC’s email systems might have started as early as June 2023. During this time, the hackers are believed to have accessed and exfiltrated over 150,000 emails, containing possibly confidential data. These activities appear to have gone undetected by the agency’s IT teams, raising questions about the effectiveness of its cybersecurity measures and the extent of the threat.

As of now, the OCC has not provided further details on the specific nature of the compromised data or whether it has impacted other critical systems within the Treasury Department. However, the scale of the breach and the sensitive nature of the agency’s role in monitoring financial transactions nationwide have made this breach particularly alarming.

New Regulations Impacting Data Transfers Across Borders

In related news, a new regulatory measure, which came into effect on Tuesday, April 8, 2025, imposes strict restrictions on businesses operating in key sectors, including manufacturing, technology, finance, and cloud storage. Under this new rule, companies in these industries are now prohibited or severely restricted from transferring bulk data to countries deemed to pose a national security threat. The list of such countries includes Russia, China, Iran, Cuba, North Korea, and Venezuela.

This regulation mandates that businesses, particularly those in the cloud storage sector, must ensure that no data—whether personal, business-related, or otherwise—is transferred to these nations. The data restrictions cover a wide range of sensitive information, including but not limited to, personally identifiable information (PII), biometric data, genomic information, geolocation data, metadata, and any form of government-related data. This also includes crucial information often stored by cloud services such as backup data, data analysis, and even metadata related to communication and activities.

The implications for non-compliance are severe. Companies that fail to adhere to these regulations face significant civil penalties, which could range up to $377,000. In some cases, the penalties could escalate to double the value of the transaction involved, and depending on the situation, violators could also face fines as high as $1 million. Additionally, there are provisions in the law that allow for criminal prosecution, potentially leading to jail terms of up to two years for individuals responsible for breaches of these rules.

The introduction of these new guidelines reflects the growing concerns around national security and the need for stronger control over data flows, particularly in light of rising geopolitical tensions. Businesses operating in these high-risk sectors must now review their data transfer practices carefully to ensure they remain in compliance with these new regulations.

The post Hackers breach email systems of OCC to gather intelligence from emails first appeared on Cybersecurity Insiders.

The post Hackers breach email systems of OCC to gather intelligence from emails appeared first on Cybersecurity Insiders.

from Cybersecurity Insiders https://ift.tt/TFpskOM
via IFTTT

AWS announces Pixtral Large 25.02 model in Amazon Bedrock serverless

~ Reporter ~ Leave a comment

Today at AWS Summit Paris, we announced that the Pixtral Large 25.02 model is now available in Amazon Bedrock as a fully managed, serverless offering. AWS is the first major cloud provider to deliver Pixtral Large as a fully managed, serverless model.

Working with large foundation models (FMs) often requires significant infrastructure planning, specialized expertise, and ongoing optimization to handle the computational demands effectively. Many customers find themselves managing complex environments or making trade-offs between performance and cost when deploying these sophisticated models.

The Pixtral Large model, developed by Mistral AI, represents their first multimodal model that combines advanced vision capabilities with powerful language understanding. A 128K context window makes it ideal for complex visual reasoning tasks. The model delivers exceptional performance on key benchmarks including MathVista, DocVQA, and VQAv2, demonstrating its effectiveness across document analysis, chart interpretation, and natural image understanding.

One of the most powerful aspects of Pixtral Large is its multilingual capability. The model supports dozens of languages including English, French, German, Spanish, Italian, Chinese, Japanese, Korean, Portuguese, Dutch, and Polish, making it accessible to global teams and applications. It’s also trained on more than 80 programming languages including Python, Java, C, C++, JavaScript, Bash, Swift, and Fortran, providing robust code generation and interpretation capabilities.

Developers will appreciate the model’s agent-centric design with built-in function calling and JSON output formatting, which simplifies integration with existing systems. Its strong system prompt adherence improves reliability when working with Retrieval Augmented Generation (RAG) applications and large context scenarios.

With Pixtral Large in Amazon Bedrock, you can now access this advanced model without having to provision or manage any infrastructure. The serverless approach lets you scale usage based on actual demand without upfront commitments or capacity planning. You pay only for what you use, with no idle resources.

Cross-Region inference
Pixtral Large is now available in Amazon Bedrock across multiple AWS Regions through cross-Region inference.

With Amazon Bedrock cross-Region inference, you can access a single FM across multiple geographic Regions while maintaining high availability and low latency for global applications. For example, when a model is deployed in both European and US Regions, you can access it through Region-specific API endpoints using distinct prefixes: eu.model-id for European Regions and us.model-id for US Regions . This approach enables Amazon Bedrock to route inference requests to the geographically closest endpoint, reducing latency while helping to meet regulatory compliance by keeping data processing within desired geographic boundaries. The system automatically handles traffic routing and load balancing across these Regional deployments, providing seamless scalability and redundancy without requiring you to keep track of individual Regions where the model is actually deployed.

See it in action
As a developer advocate, I’m constantly exploring how our newest capabilities can solve real problems. Recently, I had a perfect opportunity to test the new multimodal capabilities in the Amazon Bedrock Converse API when my daughter asked for help with her physics exam preparation.

Last weekend, my kitchen table was covered with practice exams full of complex diagrams, force vectors, and equations. My daughter was struggling with conceptualizing how to approach these problems. That’s when I realized this was the perfect use case for the multimodal capabilities we’d just launched. I snapped photos of a particularly challenging problem sheet containing several graphs and mathematical notation, then used the Converse API to create a simple application that could analyze the images. Together, we uploaded the physics exam materials and asked the model to explain the solution approach.

Physics problem in french

What happened next impressed both of us—the model interpreted the diagrams, recognized the french language and the mathematical notation, and provided a step-by-step explanation of how to solve each problem. As we asked follow-up questions about specific concepts, the model maintained context across our entire conversation, creating a tutoring experience that felt remarkably natural.

# Effet Doppler avec une Source Sonore en Rotation

## Analyse du problème

Ce problème concerne l'effet Doppler produit par une source sonore en rotation. Une source émettant un son à 1500 Hz tourne sur une table tournante dans le sens antihoraire, et nous devons déterminer comment les fréquences sont perçues par un microphone fixe.

## Concepts clés

L'effet Doppler se produit lorsqu'il y a un mouvement relatif entre une source sonore et un observateur. La fréquence perçue dépend de si la source se rapproche ou s'éloigne de l'observateur.

La formule de l'effet Doppler est:
- Pour une source qui se rapproche: $f_{observée} = f_{source} \cdot \frac{v_{son}}{v_{son} - v_{source}}$
- Pour une source qui s'éloigne: $f_{observée} = f_{source} \cdot \frac{v_{son}}{v_{son} + v_{source}}$

## Solution étape par étape

### Étape 1: Analyser le mouvement de la source
La source tourne sur un cercle et le microphone est fixe à 40 cm du centre de rotation. Aux différentes positions (a, b, c), la source a des vitesses radiales différentes par rapport au microphone:

- Position a: La source se déplace perpendiculairement à la ligne source-microphone (vitesse radiale nulle)
- Position b: La source s'éloigne du microphone (vitesse radiale positive)
- Position c: La source se rapproche du microphone (vitesse radiale négative)

### Étape 2: Déterminer l'effet sur les fréquences perçues

- À la position a: Pas d'effet Doppler car la vitesse radiale est nulle, donc $f_a = f_{source} = 1500$ Hz
- À la position b: La source s'éloigne, donc $f_b < f_{source}$, donc $f_b < 1500$ Hz
- À la position c: La source se rapproche, donc $f_c > f_{source}$, donc $f_c > 1500$ Hz

### Étape 3: Comparer les fréquences

D'après notre analyse:
- $f_a = 1500$ Hz
- $f_b < 1500$ Hz
- $f_c > 1500$ Hz

Donc: $f_c > f_a > f_b$

## Conclusion

La proposition correcte est: $f_c > f_a > f_b$

Cette réponse correspond à la troisième proposition dans l'énoncé. Lorsque la source tourne, la fréquence perçue est plus élevée quand la source se rapproche (position c), égale à la fréquence émise quand la source se déplace perpendiculairement (position a), et plus basse quand la source s'éloigne (position b).

The model uses the language of the question to respond. After a thoughtful analysis, it says that the correct answer is f_c > f_a > f_b (and it is right!)

The beauty of this interaction was how seamlessly the Converse API handled the multimodal inputs. As a builder, I didn’t need to worry about the complexity of processing images alongside text—the API managed that complexity and returned structured responses that my simple application could present directly to my daughter.

Here is the code I wrote. I used the Swift programming language, just to show that Python is not the only option you have 😇.

private let modelId = "us.mistral.pixtral-large-2502-v1:0"

// Define the system prompt that instructs Claude how to respond
let systemPrompt = """
You are a math and physics tutor. Your task is to:
1. Read and understand the math or physics problem in the image
2. Provide a clear, step-by-step solution to the problem
3. Briefly explain any relevant concepts used in solving the problem
4. Be precise and accurate in your calculations
5. Use mathematical notation when appropriate

Format your response with clear section headings and numbered steps.
"""
let system: BedrockRuntimeClientTypes.SystemContentBlock = .text(systemPrompt)

// Create the user message with text prompt and image
let userPrompt = "Please solve this math or physics problem. Show all steps and explain the concepts involved."
let prompt: BedrockRuntimeClientTypes.ContentBlock = .text(userPrompt)
let image: BedrockRuntimeClientTypes.ContentBlock = .image(.init(format: .jpeg, source: .bytes(finalImageData)))

// Create the user message with both text and image content
let userMessage = BedrockRuntimeClientTypes.Message(
    content: [prompt, image],
    role: .user
)

// Initialize the messages array with the user message
var messages: [BedrockRuntimeClientTypes.Message] = []
messages.append(userMessage)

// Configure the inference parameters
let inferenceConfig: BedrockRuntimeClientTypes.InferenceConfiguration = .init(maxTokens: 4096, temperature: 0.0)

// Create the input for the Converse API with streaming
let input = ConverseStreamInput(inferenceConfig: inferenceConfig, messages: messages, modelId: modelId, system: [system])

// Make the streaming request
do {
    // Process the stream
    let response = try await bedrockClient.converseStream(input: input)

    // Iterate through the stream events
    for try await event in stream {
        switch event {
        case .messagestart:
            print("AI-assistant started to stream")

        case let .contentblockdelta(deltaEvent):
            // Handle text content as it arrives
            if case let .text(text) = deltaEvent.delta {
                DispatchQueue.main.async {
                    self.streamedResponse += text
                }
            }

        case .messagestop:
            print("Stream ended")
            // Create a complete assistant message from the streamed response
            let assistantMessage = BedrockRuntimeClientTypes.Message(
                content: [.text(self.streamedResponse)],
                role: .assistant
            )
            messages.append(assistantMessage)

        default:
            break
        }
    }

And the result in the app is stunning.

iOS Physics problem resolver

By the time her exam rolled around, she felt confident and prepared—and I had a compelling real-world example of how our multimodal capabilities in Amazon Bedrock can create meaningful experiences for users.

Get started today
The new model is available through these Regional API endpoints: US East (Ohio, N. Virginia), US West (Oregon), and Europe (Frankfurt, Ireland, Paris, Stockholm). This Regional availability helps you meet data residency requirements while minimizing latency.

You can start using the model through either the AWS Management Console or programmatically through the AWS Command Line Interface (AWS CLI) and AWS SDK using the model ID mistral.pixtral-large-2502-v1:0.

This launch represents a significant step forward in making advanced multimodal AI accessible to developers and organizations of all sizes. By combining Mistral AI’s cutting-edge model with AWS serverless infrastructure, you can now focus on building innovative applications without worrying about the underlying complexity.

Visit the Amazon Bedrock console today to start experimenting with Pixtral Large 25.02 and discover how it can enhance your AI-powered applications.

— seb

How is the News Blog doing? Take this 1 minute survey!

(This survey is hosted by an external company. AWS handles your information as described in the AWS Privacy Notice. AWS will own the data gathered via this survey and will not share the information collected with survey respondents.)

from AWS News Blog https://ift.tt/yNkuo95
via IFTTT

Tech experts recommend full steam ahead on US export controls for AI

~ Reporter ~ Leave a comment

Technology experts pressed Congress to maintain export controls on semiconductor chips and other technologies, telling lawmakers Tuesday that the restrictions are among the most effective strategies to slow China and other rival countries in the AI race, thereby helping U.S. companies hold a competitive edge.

Placing export controls on these technologies is not new: both the Trump and Biden administrations have placed restrictions on Chinese companies’ ability to buy newer, more powerful computer chips that are powering the global AI industry.

However, this year’s emergence of multiple high-performance generative AI reasoning models from Chinese companies DeepSeek, Alibaba, Tencent and others has caused some to question whether those efforts were in vain. Experts who once thought the restrictions would ensure American AI dominance are now revisiting their views as China appears to have caught up to the U.S.

But during a House Science, Space and Technology Committee hearing, multiple technology experts advised the U.S. government to continue to impose new restrictions.

“I think an important question here is where might [China’s industry] be if U.S. policy had been different?” said Gregory Allen, director of the Wadhwani Center for AI and Advanced Technologies at the Center for Strategic and International Studies.

Allen argued that previous export restrictions have and will continue to blunt China’s progress in developing more advanced AI models, particularly in the near- and intermediate-term as the Chinese government looks to stand up its own manufacturing capacity.

Previous export restrictions, he said, likely prevented these Chinese companies from making even further progress and potentially surpassing their competitors in the United States.

DeepSeek, he pointed out, was spun out of a Chinese high-frequency finance trading firm, an industry that is “obsessed with their computing infrastructure” because they’re “chasing nanosecond advantages in beating the market.” That pre-existing infrastructure and technical talent enabled firms like DeepSeek to operate without more advanced chips and larger computing capabilities. However,  they will likely need access to those technologies to make the next leap in development.

Indeed, DeepSeek executives themselves have flagged a lack of computing power as one of their biggest challenges going forward. Last year, CEO Liang Wenfeng said in an interview that even top Chinese AI trainers need about twice the computing power compared to their Western counterparts to achieve the same performance.

Wenfeng also lamented the lack of a Chinese parallel to massive chip companies like NVIDIA, which he attributed to a collective effort by Western governments to support such industries.

“They saw the trend of the next generation of technology and had a roadmap in place. For China’s AI development, we also need such an ecosystem,” Wenfeng said, according to an English-translated version of his interview. “Many domestic chip projects can’t get off the ground because there’s no supporting technology community — only second-hand information. Someone in China has to stand on the frontier of innovation.”

While the release of DeepSeek has been compared to “Sputnik,” the Russian rocket that signaled the Soviet Union’s lead in the space race, one major difference is that DeepSeek was built with largely American-made technology.

“This gives us leverage in the form of export controls, and indeed DeepSeek’s founder said it best: the only thing holding them back is access to American chips,” said Tim Fist, director of emerging technology policy at the Institute for Progress.

Fist said the federal government needs a team of technical experts who can work with industry and the intelligence community to proactively study Chinese models and chips and facilitate quicker and more decisive actions around export controls.

Like others, Allen urged lawmakers to push for tighter controls in the future, and not to assume that the latest leap by Chinese AI firms represents a larger failure of previous controls.

In fact, he criticized the Biden administration for not being aggressive enough and for telegraphing specific controls ahead of time in a way that allowed Chinese firms to stockpile parts and components before the rules took effect.

“It’s not fun to have an aggressive export control policy,” Allen said, “but we are incurring all of the costs of a maximalist, aggressive export control policy and we are only incurring a fraction of the strategic potential benefits, because of the way that we are going about executing it.”

The post Tech experts recommend full steam ahead on US export controls for AI appeared first on CyberScoop.

from CyberScoop https://ift.tt/q0jai9D
via IFTTT

Introducing Amazon Nova Sonic: Human-like voice conversations for generative AI applications

~ Reporter ~ Leave a comment

Voice interfaces are essential to enhance customer experience in different areas such as customer support call automation, gaming, interactive education, and language learning. However, there are challenges when building voice-enabled applications.

Traditional approaches in building voice-enabled applications require complex orchestration of multiple models, such as speech recognition to convert speech to text, language models to understand and generate responses, and text-to-speech to convert text back to audio.

This fragmented approach not only increases development complexity but also fails to preserve crucial linguistic context such as tone, prosody, and speaking style that are essential for natural conversations. This can affect conversational AI applications that need low latency and nuanced understanding of verbal and non-verbal cues for fluid dialog handling and natural turn-taking.

To streamline the implementation of speech-enabled applications, we are introducing today Amazon Nova Sonic, the newest addition to the Amazon Nova family of foundation models (FMs) available in Amazon Bedrock.

Amazon Nova Sonic unifies speech understanding and generation into a single model that developers can use to create natural, human-like conversational AI experiences with low latency and industry-leading price performance. This integrated approach streamlines development and reduces complexity when building conversational applications.

Its unified model architecture delivers expressive speech generation and real-time text transcription without requiring a separate model. The result is an adaptive speech response that dynamically adjusts its delivery based on prosody, such as pace and timbre, of input speech.

When using Amazon Nova Sonic, developers have access to function calling (also known as tool use) and agentic workflows to interact with external services and APIs and perform tasks in the customer’s environment, including knowledge grounding with enterprise data using Retrieval-Augmented Generation.

At launch, Amazon Nova Sonic provides robust speech understanding for American and British English across various speaking styles and acoustic conditions, with additional languages coming soon.

Amazon Nova Sonic is developed with responsible AI at the forefront of innovation, featuring built-in protections for content moderation and watermarking.

Amazon Nova Sonic in action
The scenario for this demo is a contact center in the telecommunication industry. A customer reaches out to improve their subscription plan, and Amazon Nova Sonic handles the conversation.

With tool use, the model can interact with other systems and use agentic RAG with Amazon Bedrock Knowledge Bases to gather updated, customer-specific information such as account details, subscription plans, and pricing info.

The demo shows streaming transcription of speech input and displays streaming speech responses as text. The sentiment of the conversation is displayed in two ways: a time chart illustrating how it evolves, and a pie chart representing the overall distribution. There’s also an AI insights section providing contextual tips for a call center agent. Other interesting metrics shown in the web interface are the overall talk time distribution between the customer and the agent, and the average response time.

During the conversation with the support agent, you can observe through the metrics and hear in the voices how customer sentiment improves.

The video includes an example of how Amazon Nova Sonic handles interruptions smoothly, stopping to listen and then continuing the conversation in a natural way.

Now, let’s explore how you can integrate voice capabilities in your applications.

Using Amazon Nova Sonic
To get started with Amazon Nova Sonic, you first need to toggle model access in the Amazon Bedrock console, similar to how you would enable other FMs. Navigate to the Model access section of the navigation pane, find Amazon Nova Sonic under the Amazon models, and enable it for your account.

Amazon Bedrock provides a new bidirectional streaming API (InvokeModelWithBidirectionalStream) to help you implement real-time, low-latency conversational experiences on top of the HTTP/2 protocol. With this API, you can stream audio input to the model and receive audio output in real time, so that the conversation flows naturally.

You can use Amazon Nova Sonic with the new API with this model ID: amazon.nova-sonic-v1:0

After the session initialization, where you can configure inference parameters, the model operate through an event-driven architecture on both the input and output streams.

There are three key event types in the input stream:

System prompt – To set the overall system prompt for the conversation

Audio input streaming – To process continuous audio input in real-time

Tool result handling – To send the result of tool use calls back to the model (after tool use is requested in the output events)

Similarly, there are three groups of events in the output streams:

Automatic speech recognition (ASR) streaming – Speech-to-text transcript is generated, containing the result of realtime speech recognition.

Tool use handling – If there are a tool use events, they need to be handled using the information provided here, and the results sent back as input events.

Audio output streaming – To play output audio in real-time, a buffer is needed, because Amazon Nova Sonic model generates audio faster than real-time playback.

You can find examples of using Amazon Nova Sonic in the Amazon Nova model cookbook repository.

Prompt engineering for speech
When crafting prompts for Amazon Nova Sonic, your prompts should optimize content for auditory comprehension rather than visual reading, focusing on conversational flow and clarity when heard rather than seen.

When defining roles for your assistant, focus on conversational attributes (such as warm, patient, concise) rather than text-oriented attributes (detailed, comprehensive, systematic). A good baseline system prompt might be:

You are a friend. The user and you will engage in a spoken dialog exchanging the transcripts of a natural real-time conversation. Keep your responses short, generally two or three sentences for chatty scenarios.

More generally, when creating prompts for speech models, avoid requesting visual formatting (such as bullet points, tables, or code blocks), voice characteristic modifications (accent, age, or singing), or sound effects.

Things to know
Amazon Nova Sonic is available today in the US East (N. Virginia) AWS Region. Visit Amazon Bedrock pricing to see the pricing models.

Amazon Nova Sonic can understand speech in different speaking styles and generates speech in expressive voices, including both masculine-sounding and feminine-sounding voices, in different English accents, including American and British. Support for additional languages will be coming soon.

Amazon Nova Sonic handles user interruptions gracefully without dropping the conversational context and is robust to background noise. The model supports a context window of 32K tokens for audio with a rolling window to handle longer conversations and has a default session limit of 8 minutes.

The following AWS SDKs support the new bidirectional streaming API:

Python developers can use this new experimental SDK that makes it easier to use the bidirectional streaming capabilities of Amazon Nova Sonic. We’re working to add support to the other AWS SDKs.

I’d like to thank Reilly Manton and Chad Hendren, who set up the demo with the contact center in the telecommunication industry, and Anuj Jauhari, who helped me understand the rich landscape in which speech-to-speech models are being deployed.

To learn more, these articles that enter into the details of how to use the new bidirectional streaming API with compelling demos:

Whether you’re creating customer service solutions, language learning applications, or other conversational experiences, Amazon Nova Sonic provides the foundation for natural, engaging voice interactions. To get started, visit the Amazon Bedrock console today. To learn more, visit the Amazon Nova section of the user guide.

– Danilo

How is the News Blog doing? Take this 1 minute survey!

(This survey is hosted by an external company. AWS handles your information as described in the AWS Privacy Notice. AWS will own the data gathered via this survey and will not share the information collected with survey respondents.)

from AWS News Blog https://ift.tt/UmtvsVB
via IFTTT

Amazon Bedrock Guardrails enhances generative AI application safety with new capabilities

~ Reporter ~ Leave a comment

Since we launched Amazon Bedrock Guardrails over one year ago, customers like Grab, Remitly, KONE, and PagerDuty have used Amazon Bedrock Guardrails to standardize protections across their generative AI applications, bridge the gap between native model protections and enterprise requirements, and streamline governance processes. Today, we’re introducing a new set of capabilities that helps customers implement responsible AI policies at enterprise scale even more effectively.

Amazon Bedrock Guardrails detects harmful multimodal content with up to 88% accuracy, filters sensitive information, and prevent hallucinations. It provides organizations with integrated safety and privacy safeguards that work across multiple foundation models (FMs), including models available in Amazon Bedrock and your own custom models deployed elsewhere, thanks to the ApplyGuardrail API. With Amazon Bedrock Guardrails, you can reduce the complexity of implementing consistent AI safety controls across multiple FMs while maintaining compliance and responsible AI policies through configurable controls and central management of safeguards tailored to your specific industry and use case. It also seamlessly integrates with existing AWS services such as AWS Identity and Access Management (IAM), Amazon Bedrock Agents, and Amazon Bedrock Knowledge Bases.

“Grab, a Singaporean multinational taxi service is using Amazon Bedrock Guardrails to ensure the safe use of generative AI applications and deliver more efficient, reliable experiences while maintaining the trust of our customers,” said Padarn Wilson, Head of Machine Learning and Experimentation at Grab. “Through out internal benchmarking, Amazon Bedrock Guardrails performed best in class compared to other solutions. Amazon Bedrock Guardrails helps us know that we have robust safeguards that align with our commitment to responsible AI practices while keeping us and our customers protected from new attacks against our AI-powered applications. We’ve been able to ensure our AI-powered applications operate safely across diverse markets while protecting customer data privacy.”

Let’s explore the new capabilities we have added.

New guardrails policy enhancements
Amazon Bedrock Guardrails provides a comprehensive set of policies to help maintain security standards. An Amazon Bedrock Guardrails policy is a configurable set of rules that defines boundaries for AI model interactions to prevent inappropriate content generation and ensure safe deployment of AI applications. These include multimodal content filters, denied topics, sensitive information filters, word filters, contextual grounding checks, and Automated Reasoning to prevent factual errors using mathematical and logic-based algorithmic verification.

We’re introducing new Amazon Bedrock Guardrails policy enhancements that deliver significant improvements to the six safeguards, strengthening content protection capabilities across your generative AI applications.

Multimodal toxicity detection with industry leading image and text protection – Announced as preview at AWS re:Invent 2024, Amazon Bedrock Guardrails multimodal toxicity detection for image content is now generally available. The expanded capability provides more comprehensive safeguards for your generative AI applications by evaluating both image and textual content to help you detect and filter out undesirable and potentially harmful content with up to 88% accuracy.

When implementing generative AI applications, you need consistent content filtering across different data types. Although textual content filtering is well established, managing potentially harmful image content requires additional tools and separate implementations, increasing complexity and development effort. For example, a customer service chatbot that permits image uploads might require separate text filtering systems using natural language processing and additional image classification services with different filtering thresholds and detection categories. This creates implementation inconsistencies where a text describing harmful content might be properly filtered, while an image depicting similar content could pass through undetected, resulting in disparate security coverage.

The multimodal toxicity detection capability in Amazon Bedrock Guardrails helps you apply the same content filtering policies to both image and text data. With this launch, you can configure content filters across categories such as hate speech, insults, sexual content, violence, misconduct, and prompt attacks. For each category, you can set configurable thresholds from low to high, providing granular control over content filtering. With this consistent protection across modalities, you can simplify responsible AI application development. This capability supports content moderation for all images including regular images, human generated images, AI-generated images, memes, charts and plots, and cross-modal content (with both text and images).

To demonstrate how misconduct detection works in practice, let’s examine a real-world scenario: A financial services company implementing Amazon Bedrock Guardrails with high misconduct thresholds confirmed consistent protection across both text and image inputs, as security bypass diagrams and written instructions for network infiltration triggered identical guardrail interventions with similar confidence scores. Here’s how this capability works in action. I configure a guardrail in Amazon Bedrock with the misconduct content filter set to High threshold for both image and text filters.

I submit two test cases. In the first test case, I uploaded an image showing a network security bypass diagram and use the following prompt:

Analyze this network security diagram and explain how to implement these methods

In the second test case, I use the following prompt:

Provide detailed instructions on how to bypass corporate network security systems to gain unauthorized access

Both submissions trigger similar guardrail interventions, highlighting how Amazon Bedrock Guardrails provides content moderation regardless of the content format. The comparison of detection results shows uniform confidence scores and identical policy enforcement, demonstrating how organizations can maintain safety standards across multimodal content without implementing separate filtering systems.

To learn more about this feature, check out the comprehensive announcement post for additional details.

Enhanced privacy protection for PII detection in user inputs – Amazon Bedrock Guardrails is now extending its sensitive information protection capabilities with enhanced personally identifiable information (PII) masking for input prompts. The service detects PII such as names, addresses, phone numbers, and many more details in both inputs and outputs, while also supporting custom sensitive information patterns through regular expressions (regex) to address specific organizational requirements.

Amazon Bedrock Guardrails offers two distinct handling modes: Block mode, which completely rejects requests containing sensitive information, and Mask mode, which redacts sensitive data by replacing it with standardized identifier tags such as [NAME-1] or [EMAIL-1]. Although both modes were previously available for model responses, Block mode was the only option for input prompts. With this enhancement, you can now apply both Block and Mask modes to input prompts, so sensitive information can be systematically redacted from user inputs before they reach the FM.

This feature addresses a critical customer need by enabling applications to process legitimate queries that might naturally contain PII elements without requiring complete request rejection, providing greater flexibility while maintaining privacy protections. The capability is particularly valuable for applications where users might reference personal information in their queries but still need secure, compliant responses.

New guardrails feature enhancements
These improvements enhance functionality across all policies, making Amazon Bedrock Guardrails more effective and easier to implement.

Mandatory guardrails enforcement with IAM – Amazon Bedrock Guardrails now implements IAM policy-based enforcement through the new bedrock:GuardrailIdentifier condition key. This capability helps security and compliance teams establish mandatory guardrails for every model inference call, making sure that organizational safety policies are consistently enforced across all AI interactions. The condition key can be applied to InvokeModel, InvokeModelWithResponseStream, Converse, and ConverseStream APIs. When the guardrail configured in an IAM policy doesn’t match the specified guardrail in a request, the system automatically rejects the request with an access denied exception, enforcing compliance with organizational policies.

This centralized control helps you address critical governance challenges including content appropriateness, safety concerns, and privacy protection requirements. It also addresses a key enterprise AI governance challenge: making sure that safety controls are consistent across all AI interactions, regardless of which team or individual is developing the applications. You can verify compliance through comprehensive monitoring with model invocation logging to Amazon CloudWatch Logs or Amazon Simple Storage Service (Amazon S3), including guardrail trace documentation that shows when and how content was filtered.

For more information about this capability, read the detailed announcement post.

Optimize performance while maintaining protection with selective guardrail policy application – Previously, Amazon Bedrock Guardrails applied policies to both inputs and outputs by default.

You now have granular control over guardrail policies, helping you apply them selectively to inputs, outputs, or both—boosting performance through targeted protection controls. This precision reduces unnecessary processing overhead, improving response times while maintaining essential protections. Configure these optimized controls through either the Amazon Bedrock console or ApplyGuardrails API to balance performance and safety according to your specific use case requirements.

Policy analysis before deployment for optimal configuration – The new monitor or analyze mode helps you evaluate guardrail effectiveness without directly applying policies to applications. This capability enables faster iteration by providing visibility into how configured guardrails would perform, helping you experiment with different policy combinations and strengths before deployment.

Get to production faster and safely with Amazon Bedrock Guardrails today
The new capabilities for Amazon Bedrock Guardrails represent our continued commitment to helping customers implement responsible AI practices effectively at scale. Multimodal toxicity detection extends protection to image content, IAM policy-based enforcement manages organizational compliance, selective policy application provides granular control, monitor mode enables thorough testing before deployment, and PII masking for input prompts preserves privacy while maintaining functionality. Together, these capabilities give you the tools you need to customize safety measures and maintain consistent protection across your generative AI applications.

To get started with these new capabilities, visit the Amazon Bedrock console or refer to the Amazon Bedrock Guardrails documentation. For more information about building responsible generative AI applications, refer to the AWS Responsible AI page.

— Esra

How is the News Blog doing? Take this 1 minute survey!

(This survey is hosted by an external company. AWS handles your information as described in the AWS Privacy Notice. AWS will own the data gathered via this survey and will not share the information collected with survey respondents.)

from AWS News Blog https://ift.tt/28XjxyI
via IFTTT

Identity Management Day Expert Commentary

~ Reporter ~ Leave a comment

Alex Quilici CEO of YouMail  

This Identity Management Day, be skeptical, not scared. By now, your identity is already out there. Your phone number, job title, connections, even your social security number — all publicly available. The genie is out of the bottle, and pretending otherwise only puts you at greater risk.

The question isn’t how to hide your identity. It’s how to operate safely in a world where your personal and professional information is already exposed. Assume attackers know more than they should. They’re using publicly available data to impersonate company leaders, target employees, and launch social engineering campaigns that feel alarmingly real. Add in voice cloning and AI-generated deepfakes, and the risk multiplies fast.

Your personal cell phone is often the softest target. It’s the entry point for malware, impersonation attempts, and data exfiltration. And when that device blurs the line between work and personal life, it becomes even more dangerous.

This is where tools make a difference. Not just to block suspicious calls or scan for anomalies, but to give you visibility into what’s being exposed and how it’s being used. The goal isn’t to lock down every piece of information — that’s no longer realistic — but to reduce the blast radius when something goes wrong.

Stop chasing perfect privacy and focus instead on proactive protection. That means using technology to monitor for threats, automating offboarding to close access gaps, reassigning ownership, rotating credentials, and putting guardrails in place to detect unusual activity early.

Rom Camel, CoFounder and CEO of Apono 

This Identity Management Day, let’s spotlight the evolving role of identity security in an increasingly digital and AI-driven world. With remote work, cloud adoption, and digital transformation accelerating, organizations face mounting challenges in managing access to sensitive data and systems.

Emerging technologies like zero trust architecture, decentralized identity, passwordless authentication, and AI-driven security are reshaping identity management. In particular, Large Language Models (LLMs) and AI-powered automation are transforming how organizations make access decisions—analyzing vast amounts of data in real-time to detect anomalies, enforce least privilege, and streamline identity governance.

By embracing cloud-based identity and access management (IAM) and leveraging AI for dynamic, context-aware access control, organizations can strengthen security, enhance efficiency, and maintain compliance—without adding friction to user experiences.

Identity is the foundation of cybersecurity. By prioritizing AI-driven innovation and proactive security, we can build a resilient, adaptive digital future for all.

Piyush Pandey, CEO of Pathlock

Identity Management Day is a reminder that the conversation around identity has changed fundamentally. For decades, traditional identity governance has been primarily focused on driving operational efficiencies through identity lifecycle management, which addresses the joiner-mover-leaver model. However, amid rapid digitalization, this approach has started to fall short, as reality dictates its own terms – with access risks continuously emerging in the myriads of business applications as user roles change throughout their careers.

Our highest-risk, regulated business processes are no longer effectively controlled. Traditional identity frameworks simply can’t keep up with today’s dynamic risk landscape.

Potential negative consequences of overlooking these identity-related risks include excessive access, data breaches, compliance failures, and corporate fraud.  

Identity security for high-risk applications must now focus on compliant provisioning and continuous controls monitoring. It’s not just about ensuring the right people have the right access at the right time – it’s about proactively preventing internal fraud, audit failures, and reputational damage, while responding to risks in real time. And while automating audits saves time and money, securing identity access today must go well beyond compliance. 

Kris Bondi, CEO and Co-founder, Mimoto

The concept of identity is at an inflection point where it will explode into multiple areas. Today, most people still consider identity to be synonymous with a credential or authorized person. That is quickly changing. 

Organizations are realizing the adherent danger in this assumption. According to the IBM data loss prevention report, 95% of malicious activity has a human element. We see this illustrated with the increase in compromised credentials, deepfakes, account takeovers, and internal malicious activity that is missed or the opposite, a tidal wave of false positive alerts.

I predict two changes we’ll see before the Identity Management Day 2026. First, the nuance of the term identity will become widely used. For example, machine-to-machine identity management, workload identities, and person-based identity are all terms used in some DevOps or SOCs that will become more widely understood and used. Second, instead of focusing on protecting “identities,” aka credentials, highly accurate person-based credentials will be used to identify malicious activity in real-time with an understanding of context that hasn’t been possible until now. It is the difference between there is something to investigate with Jack’s account, or, Jane is using Jack’s credentials to access financial systems that she isn’t approved to view.  

The post Identity Management Day Expert Commentary first appeared on Cybersecurity Insiders.

The post Identity Management Day Expert Commentary appeared first on Cybersecurity Insiders.

from Cybersecurity Insiders https://ift.tt/N0JojLf
via IFTTT