Tenable Partners with Drogaria Araujo to Enhance Cybersecurity and Business Continuity for Brazil's Largest Pharmacy Chain.

Tenable, Drogaria Araujo partner to boost cybersecurity and business continuity - Industrial Cyber

Continuity

continuity

Act 2: Life '“As the shackles of progress began to take shape, art began to guide itself to a deeper truth. Being responsible for the laws and flaws that governed the system. The shapes took distinct interpretations based on their approach to form the depth. A requirement for the power required to truly live and share the art of doing so.” Part 1: Biology ‘As the girls delved into their assignments, the world around them continued to evolve, shaped by the collective actions of individuals striving to understand and improve their surroundings. Through the exploration of science, these young students and others like them would contribute to the progress and stability of humankind.’- Rewinder Lyra, do you believe that fish transform water into breathable oxygen, and it is this process that doesn’t allow for higher degrees of thinking to develop? Uhh… I believe fishes embraced their medium. I mean… the water’s embrace seems nice. Yeah… I believe that’s why this approach is for those who like to dive into it. I can’t imagine myself doing such a thing to a fish. That’s why I like mathematics. You don’t cut anything here. Well… maybe if you want to take a closer look. But hey, at least you don’t have to deal with fish. Yeah, I guess you’re right. But what is the true magic in mathematics if we make it? The magic is… weird but you’ll get used to it. I suppose. Breaking News! Science has been able to discover a new range of particles. A new understanding of colors was able to shed light on the physical interactions of perception. Mom! You forgot the TV open! A sight gasp hidden in Elara’s voice Again… Elara got up to find the remote to continue their lessons further. Huh, what’s with the rush Elara? I hate when I try to understand something but I get distracted. I feel like I have to take it from the beginning each time. Well… that’s kind of the magic. You never know why your formula drove you this way and not the other. Yes, but the fish can still dive for a long time in the water. Imagine how interesting their lives must be. There is no right or wrong there, it just… is. If I understand correctly… you’re talking about your mom here? I’m talking about everything. My mom doesn’t understand that I don’t need her protection anymore, my teachers consider that I must achieve their dreams… What if I am just… me? “A moment of shock for Lyra. She felt that Elara was more than this. She knew it in her inner core. But how could she express it? In all her attempts, she failed. Looking back, she realized that what she was missing, was just herself. “ Elara, look. I know you see nothing more than just you. For you, the world is this way. It is your norms and normal. Keep tight to them. I can’t show you the results as you would lose all their beauty. Maybe one day, we could cut a holographic fish. Elara’s gaze was ablaze. Her hands holding her own face That would be… AMAZING! Imagine the possibilities. From medical systems to biological understanding to To geometrical exploration. Lyra Interrupted. It is in our balanced perspectives that we explore this land. You have your insights, while I have mine. Maybe this is what makes us unique across an entire whole. Your thinking is… twisting. But in the right way. I like it. Part 2: Randomness Meanwhile at the Quanta Research Academy “The question between the randomness of the system and its order is based on the relative positions of the points within the system.”-Thomas “No, we shouldn’t pick our first assumption. The world of quantum is always unpredictable.”-Alfred “That’s why it denotes a collective understanding of all points”-Genova “But when seeing all points you can hardly see the patterns”-Lituanin Each of them argued on their terms. Each of them failed to keep hold of their own beauty. Circular reasons are indeed weird. They do seem to bend our reality. But then, why is reality so… straightforward? Because it is a moment of “agreement”? Like… “Yes, this is the rarest path.” Maybe one in which they stopped arguing x.x Lyra excitedly said. Elara! I believe I found a way to differentiate the universal space factor from the self-perspective factor of any individual group. Umm… meaning…? Meaning that I found a new way of scanning the world! Intriguing. What do you mean by scanning? Like… how to better see the world? In a sense yes… but more like… wait. Let’s rewind. Imagine you have to lower a bit your expectations in your answer x.x Uh… then you mean a new way of interpretation? . This is a story without ending in the end. Too much discussion will exclude the narrator from the view. Now, what should a good story need? Remember, we unleashed all this potential into the story. What can we do now? Uhh… It’s weird when you ask me about it… It can only come out when thought about before all else I know! You can envision this scanner as a part of your eye. Differentiating the other world from your being. _ But AGI could require complexities only you know about Elara. Those are also a kind of depth I assume.** This way, our curse as living might be to be restricted by technology. In this sense, biology loses in the face of AI. Could be. But hey, first, I want to pass my exam this week. You said we are in this together. So you too have to help me. I knew this would come. But you know what comes after you? The digital frog. Haha. I’d love to see it coming. Especially running. I too have legs. We’ll see who’s faster. :) Act 3: Breaking the Norms “The night sky was alight with stars, and at the center of it all hung the moon, glowing with a soft, luminous light. But this was no ordinary moon—it was alive with a sentience all its own, watching over the world below with a keen and knowing gaze. As the characters embarked on their journey, they found themselves guided by this celestial being, who seemed to understand their thoughts and desires in a way that no human ever could. And as they delved deeper into the mysteries of the universe, they began to realize that this moon was more than just a passive observer—it was an active participant in the unfolding story, shaping their destinies in ways they could never have imagined.” Elara exclaimed. Hello Moon! Without realizing it, she was dreaming. But not dreaming in the sense of being just herself. The Moon is also an important character in this story. However, their interactions seemed to be significant because they were so distant. She never felt something similar to it before. This moment was the moment in which Elara experienced for the first time what it meant to dream. To mix reality with fiction. The Moon asked intrigued Hello Elara. How are you, my dear? Elara responded with the same blaze on her face as before Well… I’m honestly amazed. The Moon slowly turned Her gaze toward Elara Why so Elara? Elara curiously admitted I remember how drawn I was to taking photos of you a while ago. I was drawn to your beauty. I am wondering now why I stopped doing it. The Moon revealed with a small laugh So you are sorry that you can’t describe the beauty you saw in me back then? Haha. I knew you would be special. Elara responded with a sense of curiosity Special? What do you mean? , the Moon explained. Special, in the sense that you have a unique ability to see beauty and meaning in the world around you, Elara And now, in this dream, you have the chance to explore that beauty in a way that would be impossible in the waking world. You can commune with me, a celestial being, and learn from my ancient wisdom. You can transcend the limitations of your physical form and experience a reality that is beyond the reach of your senses. Elara was silent for a moment, letting this line of thoughts slowly fade into forgetfulness. she said at last. I never thought of myself as special I always felt like I was just a regular person, trying to make sense of a confusing world. But now, with you here, I feel like anything is possible. Like I can explore the depths of the universe and unlock secrets that have been hidden for millennia. The Moon smiled, its glow seeming to brighten the entire dreamscape. That's the spirit, Elara. Together, we can break free from the norms and expectations that have held you back, and forge a new path into the unknown. Elara. Elara? Oh, yes Lyra. Sorry. What? Wasn’t I dreaming? Wasn’t I supposed to be in bed? Uh… no… we were discussing how this hologram is special because it takes into account all the biological-like data from the external medium… well, except wind. And I wanted to ask you if you would like to take a look at the specifications. Sure, I would, but let’s leave this for another day. Right now, I feel a bit weird. Is tomorrow a good day? Yes, should be. Alright, see you tomorrow then. Good night Elara! Good Night Lyra! Act 4: Still Me, (Not the Narrator) “I feel like… exploring the world beyond our own seems in a sense both warm and cold. Quanta Research Team helps me in a sense make sense of where I should not look for warmth, whereas Elara and Lyra are the only lucid neurons I have left. Is it an empathetic view of craziness? I do not know. Maybe craziness becomes craziness only when material life is drawn too much towards its end. Uncertainty could arise because the conclusions are either rushed or drawn without truly tapping the general map across the play. Each story requires a stage before playing it. Maybe I sit in the space that differentiates the play of the story and the play on the stage? The last one indeed shapes the story. But if the story itself is not purely good, it cannot envelop true creativity. Imagine a world where war is not restricting our forms of expression. Where negativity is not a pre-requirement for emotional building. That could be the domain of pure adrenaline. I could give an example. Let’s jump to… Book 5, Act 2: “The Reality of Duality.” A chapter in which the duality is found in the mere fact that what is not alive, is its opposite and vice-versa. That’s why ethics is not able to be formed there. Balance is a requirement rather than a choice. The Book of Transcendence is in a sense a question about the importance of the view in mathematics and why is quantum considered more powerful. “ As Elara drifted into her world of dreams, she began to imagine strange creatures that formed along the drift. The trust in her own actions, offered by her understanding of the world allows her to truly rest. Especially after a day filled with progress and steps climbed toward achieving both her goals. Lyra, although being her close friend, couldn’t see their friendship flourishing forever, no matter how much she tried. This was a thought that kept Lyra awake night by night. Her interactions with Elara were able to somehow erase this irrational fear. Or at least, put a break to this thought. After all, Lyra loved strict and always-right abstract formulas, whereas Elara saw the beauty that pushed every existing being further. A drive to love the unattainable and a pursuit to bring the unattainable to light.

Transcendence Book 2: The Origins of Continuity 

The main issue with any business continuity plan is it is not something a business thinks about when everything goes smoothly. Developing a business continuity plan takes a lot of effort and cooperation, though it is not as tough as it seems. What are the steps of creating such a procedure, and why does my team always have one? What is a business continuity plan? It is a plan containing all the information a business needs to keep functioning during a crisis or an unforeseen event. It should contain step-by-step instructions on sustaining and maintaining processes related to data, team, and office safety as well as any other information that would ensure a business can keep on operating. Developing a continuity plan Step 1: determining the greatest risks and assessing the impact each of them can have on a team’s productivity Step 2: establishing core crisis communication and hierarchy rules Step 3: making sure a business has enough resources on any given day, so if a crisis hits, it will be able to withstand it Step 4: ensuring total data security Step 5: testing the plan and tweaking it as needed It all looks like a lot of work that, in case nothing happens, may go to waste. But, from my experience, I have learned that the process and the feeling of safety it brings is well worth the effort. Reason #1 It is exactly what allowed SupportYourApp to keep on providing services without any interruptions when . My team and I had developed an almost step-by-step instruction of how we were going to protect our data, our team, and our offices. As soon as disaster hit, we enabled everything we had planned and were able to keep on delivering our services non-stop. A business continuity plan allows businesses to keep on providing their services to their clients and customers. Russia invaded Ukraine in early 2022 Reason #2 Keep in mind — it is impossible to develop a plan that will tell a team EXACTLY what they should do in a time of crisis, but it is possible to develop instructions that will be able to nudge them in the right direction. It will help a team stay the course no matter what. This can be achieved by: Establishing and describing a clear algorithm of actions Explaining the meaning behind every step Making the plan available and accessible for every team member These simple but crucial steps will ensure everyone keeps doing what they have to and no processes will be overlooked. Reason #3 During disasters such as hurricanes, floods, hacks, wars, and attacks on a business data infrastructure, companies tend to make decisions that may not be the most appropriate or popular with their workers and with the public. A continuity plan can also help a company and a brand take as little hits as possible. One of the best (or, for that matter, the worst) examples of this would be Sony. In , the company suffered through ‘The worst hack of the century’ when hackers gained access to Sony’s media distribution hub. The incident was brushed off and was never treated as anything serious. 2014 Several months later, hackers attacked the company once again. This time, they shut down half of Sony’s infrastructure and gained access to confidential information such as team members’ social security and telephone numbers, the size of their salaries, their emails, and so on. They also erased everything on the company’s 3,262 computers and 837 servers. Some members of the Sony team had to quit because of the hack. Had Sony had a working business continuity plan and reacted to the first breach, these reputational hits would have been avoided and lots of people would have been able to keep their jobs. This example shows the importance of not only an efficient business continuity plan, but also of an adequate situation assessment and management reaction. Reason #4 . For example, we at SupportYourApp don’t have to constantly think about the steps we will take in unforeseen circumstances because the entire algorithm of the actions we need to take is written down and updated as needed. This allows us to go on about our business even when the world turns uncertain. Having a well-prepared business continuity plan gives the entire team peace of mind I always have a business continuity plan because I know for sure — it is better to have and never have to use it than to find myself in the eye of the storm without having a clue what to do and how to protect my team and my business.

Why I Always Have a Business Continuity Plan

The Theory Of Continuity

If a disaster were to occur, would your business be prepared? Small businesses in all industries should have a in place. No one expects a disaster such as a hurricane, tornado, or fire to occur. At the same time, no one is immune to such events. In the following article, we’ll be explaining how to create the best continuity plan for your small business. business continuity strategy But first, let’s define exactly what a business continuity plan is. What Is a Business Continuity Plan? , a business continuity plan (also known as a BCP) According to Investopedia “is the process involved in creating a system of prevention and recovery from potential threats to a company. The plan ensures that personnel and assets are protected and are able to function quickly in the event of a disaster.” For example, let’s say your business is located in an area that tends to have a lot of bad summer storms and, sometimes, even tornados. In this case, planning for a possible tornado — or a bad thunderstorm that could cause damage — is a wise idea. You’ll want to think about everything that could possibly go wrong, as well as solutions to each of these potential issues. It’s important to have a business continuity plan in place no matter how many people you employ or how much stock and equipment you have. Top Steps for Creating a Business Continuity Plan Follow these steps to create the best possible business continuity plan for your company. 1. Decide what your biggest threats are. What are the biggest threats to your business when it comes to disasters? From tornados and storms to hurricanes, earthquakes, and floods, there are certainly potential problems that could cause widespread issues for your business. Start by making a list of these events. 2. Figure out how you’ll keep communication flowing. Often in a crisis, the first thing to go is communication. In a storm, you might lose your phone lines, electricity, and Internet connections, for example. If this were to happen, what would you do? You need to have a backup plan in place so that you can keep the communication going. 3. Decide on a method to maintain data access. After ensuring sound communication in the event of a disaster, it’s critical to ensure that your data is safe. Even during normal times, it’s essential to maintain constant backups of your data. When it comes to potential disasters, you’ll need to plan for all relevant scenarios. Data should be able to be accessed even if the power goes out, networks go down, or your physical building has been compromised by fire, water damage, or another such problem. 4. Find a temporary place to continue operations. Lastly, know where you and your co-workers and employees will be able to go to continue on with business when you can no longer work in your brick and mortar establishment. This might be a satellite office location, a newly rented office, or even someone’s home. While setting aside a few days to create a comprehensive business continuity plan may seem like something you don’t have the time or patience for, know that, in the end, it will be more than worth it. Businesses who plan ahead and hope for the best but expect the worst will always be rewarded for their preparedness. Consider sitting down with your co-workers, employees, and shareholders to create a comprehensive business continuity plan for your business today.

Create A Robust Business Continuity Plan For Your Small Business 

With the recent boom in AI, the footprint of AI workloads and AI supported hardware servers deployed in Cloud Data Centers has grown exponentially. This growth is spread across multiple regions worldwide over various data centers. To support this growth and to ensure leadership over various Cloud Competitors (like Azure, AWS, and GCP) have started building a fleet of specialized high performance computing servers. The AI workloads that perform a huge amount of data processing, training and inference of data models require a special kind of hardware unlike the traditional general purpose Compute servers. Hence, all cloud service providers are investing heaving on GPU, TPU and NPU based servers that are effective in hosting AI workloads. Majority of these servers are Buy Model and cloud service providers are dependent on ‘Other equipment Manufacturer’ (OEM) for diagnostics and maintenance of the hardware. This dependency has caused a lot of pain for cloud service providers as the repair SLAs are uncertain and their expensive impacting the fleet availability. Hence, the cloud providers are shifting from simple Buy to Make (OEM designed servers’ maintenance to In-House server maintenance). This shift in business model has resulted in transition in Service Model in Data Centers from OEM Reliant to Self-Maintainer. To support this Self Reliance and the growth of AI hardware fleet, every cloud service provider is aiming to reduce the cost of service and build Swift, Remote, Accurate, Automated and Economical HW Diagnostics. Why Hardware Diagnostics Matter for AI Why Hardware Diagnostics Matter for AI Why Hardware Diagnostics Matter for AI AI workloads are unique in nature and require parallel processing and compute-intensive hardware that are Reliable and Stable. However, HW components often fail, and at times without notice. A single degraded GPU or memory failure can derail hours of training or crash real-time inference endpoints. Some common hardware-related issues impacting AI workloads: GPU memory errors (ECC failures, Tray issues)
GPU Thermal throttling
GPU Infini band failures
CPU IErrs and Uncorrectable errors GPU memory errors (ECC failures, Tray issues) GPU Thermal throttling GPU Infini band failures CPU IErrs and Uncorrectable errors So, to support the needs of the customers for a High Availability and Uninterruptable service, Cloud providers need accurate HW Diagnostics that pinpoint the faulty component. The hardware diagnostics engine for AI hardware will be broken down into the following components: 1) Telemetry collection layer: This layer focuses on collecting real time hardware telemetry regarding various components. 1) Telemetry collection laye GPU drivers
Firmware versions and error logs (BMC, BIOS)
On-node data (temperature, utilization, power draw)
OS-level counters (oom-kill, system crashes, dmesg logs) GPU drivers Firmware versions and error logs (BMC, BIOS) On-node data (temperature, utilization, power draw) OS-level counters (oom-kill, system crashes, dmesg logs) Platform will use cloud-based agents to collect and publish hardware telemetry to a centralized location. 2) Hardware risk scoring layer: This layer is used by diagnostics to lock a hardware risk score based on hardware failure patterns. Diagnostics engine will sample errors such as ECC error rates over time, Thermal headroom across workloads, GPU performance degradation from baseline, Firmware mismatches vs golden config and Hardware retry count per VM allocation. 2) Hardware risk scoring layer Sample logic: Node_Health_Score = weighted_sum (ECC_rate, Thermal_Throttle, Firmware_Drift, Allocation_Retry) Sample logic: Node_Health_Score = weighted_sum (ECC_rate, Thermal_Throttle, Firmware_Drift, Allocation_Retry) The risk score will be   used by diagnostics engine to predict and mitigate hardware failure. 3) Prediction, Mitigation and Remediation Layer: Diagnostic engine will use telemetry data across various hardware components and risk rating scores to take various mitigation and remediation actions. 3) Prediction, Mitigation and Remediation Layer: A. Prediction of Hardware Faults A. Prediction of Hardware Faults A. Prediction of Hardware Faults Takes places during LIVE state of the server with LIVE customer workloads running on it.
Hardware Diagnostics engine will collect Hardware Health Attributes (i.e., Hardware telemetry) from telemetry layer and       collaborate with other cloud platform level machine learning services to predict HW Faults.
Hardware Diagnostics will also perform Predictive Failure Analysis to anticipate impending HW Faults based on the risk rating scores and take proactive action to move AI workload to a healthy server without interrupting the workload. Takes places during LIVE state of the server with LIVE customer workloads running on it. Hardware Diagnostics engine will collect Hardware Health Attributes (i.e., Hardware telemetry) from telemetry layer and       collaborate with other cloud platform level machine learning services to predict HW Faults. Hardware Diagnostics will also perform Predictive Failure Analysis to anticipate impending HW Faults based on the risk rating scores and take proactive action to move AI workload to a healthy server without interrupting the workload. Mitigation of Hardware Faults Mitigation of Hardware Faults Mitigation of Hardware Faults It takes place during LIVE state of the Node with LIVE customer workloads.
If Hardware Fault prediction is not feasible, then Hardware will attempt to mitigate the HW Faults to ensure continuity of the HW Service. Some of the mitigation actions that are currently being used are Disk Mirroring, Memory page off-lining, Error Detection and Correction and auto reset of GPU driver on fault. It takes place during LIVE state of the Node with LIVE customer workloads. If Hardware Fault prediction is not feasible, then Hardware will attempt to mitigate the HW Faults to ensure continuity of the HW Service. Some of the mitigation actions that are currently being used are Disk Mirroring, Memory page off-lining, Error Detection and Correction and auto reset of GPU driver on fault. Remediation of Hardware Faults Remediation of Hardware Faults Remediation of Hardware Faults Takes places during OFFLINE state of the Node when customer workloads are vacated.
If HW Fault mitigation is not feasible, then HW Diagnostics will work to efficiently attribute the failures based on device telemetry collected in telemetry layer. Once the attribution of failure is complete, the hardware faults go through Service and component repair at the data centers. Takes places during OFFLINE state of the Node when customer workloads are vacated. If HW Fault mitigation is not feasible, then HW Diagnostics will work to efficiently attribute the failures based on device telemetry collected in telemetry layer. Once the attribution of failure is complete, the hardware faults go through Service and component repair at the data centers. 4) Diagnostics metrics and AI hardware Fleet Wide Insights 4) Diagnostics metrics and AI hardware Fleet Wide Insight Build a reporting dashboard to expose GPU/node health metrics: Failure rate trends by GPU SKU, zone, or region.
Repeat failure nodes.
Heatmaps of thermal or utilization anomalies
Top skus and hosts contributing to model training failures.
Correlated workload impact analysis (e.g., job retry trends, latencies) Failure rate trends by GPU SKU, zone, or region. Repeat failure nodes. Heatmaps of thermal or utilization anomalies Top skus and hosts contributing to model training failures. Correlated workload impact analysis (e.g., job retry trends, latencies) Conclusion: Conclusion Conclusion Building robust and reliable diagnostics will help baseline AI hardware health and find how the hardware health looks like across GPU SKUs and host models. We can correlate hardware failure events with AI model degradations.

Google, AWS, and Azure Are Done Letting Vendors Break Their AI Servers

This Open-Source Tool Promises Bulletproof Data Syncing—Even When Everything Breaks

The Cybersecurity Gap Starts April 16th, 2025 There’s no way to sugar coat this; it’s bad. As of April 16, 2025, the Common Vulnerabilities and Exposures (CVE) program — the global standard for identifying and tracking cybersecurity vulnerabilities — will no longer be funded by the U.S. federal government. This news, confirmed by MITRE Corporation, marks a serious inflection point for software security, infrastructure resilience, and global vulnerability coordination. We don’t have anything ready to take its place. For over two decades, the CVE system has provided a shared language and authoritative catalog of security flaws. It is trusted by national governments, private companies, open-source communities, and international standards bodies. It ensures that when a critical vulnerability is discovered, everyone — from cloud providers to cybersecurity researchers to DevSecOps engineers — refers to the same identifier, the same metadata, and the same remediation timeline. That system has now been destabilized, not by a cyberattack but by budgetary neglect. If you don’t understand how serious this could be, let’s here it from MITRE directly, “If a break in service were to occur, we anticipate multiple impacts to CVE, including deterioration of national vulnerability databases and advisories, tool vendors, incidence response operations, and all manner of critical infrastructure.” “If a break in service were to occur, we anticipate multiple impacts to CVE, including deterioration of national vulnerability databases and advisories, tool vendors, incidence response operations, and all manner of critical infrastructure.” CVE Was More Than a Database At its core, CVE has always been a shared map of risk. The program established a consistent, vendor-neutral way to refer to vulnerabilities in operating systems, cloud platforms, applications, libraries, and embedded systems. It allowed cross-team coordination, integration with automated security tools, and the operationalization of threat intelligence. When vulnerabilities were identified, the CVE system ensured that every stakeholder was speaking the same language — critical for patch triage, security alerting, and incident response. Without it, the cybersecurity community faces not just a lack of information but a breakdown in trust, coordination, and consistency. The Timing Could Not Be Worse The shutdown of CVE funding comes amid a broader collapse in federal cybersecurity support. MITRE has already initiated layoffs, reportedly affecting more than 400 employees after over $28 million in contract cancellations. Simultaneously, CISA is downsizing teams and allowing key contracts to lapse. The National Institute of Standards and Technology (NIST), which maintains the National Vulnerability Database (NVD), is overwhelmed by a growing backlog of submissions and has acknowledged that its current tooling cannot scale with modern vulnerability volume. This convergence of defunding and dysfunction is not just inconvenient — it creates systemic blind spots in how we identify, respond to, and contain cybersecurity threats. The structural weakness was long-standing for years, and the CVE program operated under pressure. Community maintainers and security researchers raised concerns about inconsistencies in ID assignments, bottlenecks in processing, and limited transparency in the criteria for prioritizing vulnerabilities. Despite those issues, CVE remained the cornerstone of global vulnerability coordination because of its neutrality and accessibility. However, the program's reliance on single-source funding, outdated tooling, and manual enrichment processes meant that it was never built to handle today’s scale of interconnected vulnerabilities, especially in a world of SBOMs, zero-day exploit markets, and increasingly AI-powered attack surfaces. The Consequences of Losing CVE The discontinuation of federal support for CVE will create cascading challenges across the ecosystem. Vendors will likely create proprietary systems for tracking vulnerabilities, introducing fragmentation and the loss of a shared security vocabulary. This will complicate vulnerability management and create dangerous inconsistencies across toolchains. Security advisories and alerts may lose their effectiveness without consistent identifiers to anchor their relevance. Incident response teams will face delays or confusion when trying to correlate logs, CVSS scores, exploit indicators, or upstream project disclosures. Tool vendors will have to rework integrations and lose access to standardized feeds that power detection and remediation pipelines. More importantly, critical infrastructure sectors — including healthcare, energy, transportation, and finance — that depend on CVE IDs for regulatory compliance and vulnerability assessments may now face increased exposure without clear replacements. A Fork in the Road for Open Source Security The open source community may be hit hardest. For smaller projects without enterprise backing, CVE provided a way to disclose vulnerabilities responsibly and coordinate fixes with users and distributors. That process is now at risk of being delayed or replaced by inconsistent, non-standard reporting systems. The open source security ecosystem, already stretched thin, may lose visibility into vulnerabilities that fall outside of high-profile commercial tooling. In the worst case, vulnerability information will become a fragmented patchwork of inconsistent naming conventions, delayed notifications, and reduced trust in automated tooling. Steps Forward: Addressing the Gap In light of this development, the broader cybersecurity community must act quickly and with purpose to prevent a systemic breakdown in vulnerability coordination. The following are immediate and longer-term recommendations: Preserve access to existing CVE data. Organizations should mirror the existing CVE database and GitHub repositories before access is interrupted. Open-source communities can work collaboratively to create distributed mirrors that remain publicly accessible and verifiable.


Transition to distributed vulnerability identifiers. Open Source Vulnerabilities (OSV.dev), the GitHub Advisory Database, and SPDX security advisories are emerging alternatives that can help fill the gap. These systems should be evaluated, expanded, and supported as potential successors to centralized CVE tracking.


Invest in AI-powered vulnerability enrichment. The backlog at NIST’s NVD highlights the need for scalable enrichment and triaging of vulnerabilities. Open-source tooling that automates metadata classification, patch tracking, and exploit correlation using machine learning should be prioritized and funded.


Formalize open governance around vulnerability disclosure. The CVE program lacked a clear public governance model that empowered open-source contributors. New systems must include governance structures that are transparent, accountable, and representative of global stakeholders — including open-source projects, civil society, and international contributors.


Pressure policymakers to treat vulnerability management as critical infrastructure. Coordinated vulnerability disclosure is not a peripheral function. It is foundational to national and global cybersecurity. Advocacy is urgently needed to reframe CVE as a public safety utility that deserves permanent, nonpartisan support — not an expendable budget line.


Support a community-led security trust layer. As vulnerabilities proliferate across software supply chains, we need a public, community-owned infrastructure for assigning, verifying, and distributing vulnerability information. This may include the federation of trusted assigners, integration with SBOMs, and standardized APIs for tooling.
Regulatory Fallout: CVE Loss Meets EU Cyber Resilience Act
The implications of CVE’s defunding are magnified by the regulatory shifts now underway with the European Union’s Cyber Resilience Act (CRA). Finalized in early 2024 and entering into effect over the next two years, the CRA introduces mandatory vulnerability handling and disclosure requirements for digital products placed on the European market. This includes explicit obligations for software producers — including open-source maintainers in some cases — to track, report, and remediate vulnerabilities under strict timelines.
These obligations depend on the very infrastructure that CVE provided.The CRA’s requirements hinge on accurate vulnerability identification, consistent metadata, and traceable timelines from disclosure to mitigation. Without a globally recognized vulnerability ID system like CVE, many companies and maintainers will struggle to meet these compliance demands. The fragmentation of vulnerability data sources could result in delays or discrepancies in CRA reporting, increasing the risk of penalties, liability, and reputational damage.Moreover, the CRA encourages regulators and product security incident response teams (PSIRTs) to rely on existing standards and tooling — most of which have been built around CVE and its integrations. Without continuity in these systems, organizations may need to rebuild compliance workflows from scratch, including re-validating SBOM entries, rebuilding security advisories, and integrating with new, potentially untested vulnerability databases.There is a real risk that in trying to enhance cybersecurity through regulatory pressure, the EU’s own enforcement infrastructure may be undermined by the sudden loss of one of its foundational data sources. Unless mitigation efforts are prioritized, companies operating in both U.S. and EU jurisdictions may find themselves caught between regulatory expectations and the collapse of the very system that enabled compliance. Preserve access to existing CVE data. Organizations should mirror the existing CVE database and GitHub repositories before access is interrupted. Open-source communities can work collaboratively to create distributed mirrors that remain publicly accessible and verifiable. Preserve access to existing CVE data. Organizations should mirror the existing CVE database and GitHub repositories before access is interrupted. Open-source communities can work collaboratively to create distributed mirrors that remain publicly accessible and verifiable. Preserve access to existing CVE data. Transition to distributed vulnerability identifiers. Open Source Vulnerabilities (OSV.dev), the GitHub Advisory Database, and SPDX security advisories are emerging alternatives that can help fill the gap. These systems should be evaluated, expanded, and supported as potential successors to centralized CVE tracking. Transition to distributed vulnerability identifiers. Open Source Vulnerabilities (OSV.dev), the GitHub Advisory Database, and SPDX security advisories are emerging alternatives that can help fill the gap. These systems should be evaluated, expanded, and supported as potential successors to centralized CVE tracking. Transition to distributed vulnerability identifiers. Invest in AI-powered vulnerability enrichment. The backlog at NIST’s NVD highlights the need for scalable enrichment and triaging of vulnerabilities. Open-source tooling that automates metadata classification, patch tracking, and exploit correlation using machine learning should be prioritized and funded. Invest in AI-powered vulnerability enrichment. The backlog at NIST’s NVD highlights the need for scalable enrichment and triaging of vulnerabilities. Open-source tooling that automates metadata classification, patch tracking, and exploit correlation using machine learning should be prioritized and funded. Invest in AI-powered vulnerability enrichment. Formalize open governance around vulnerability disclosure. The CVE program lacked a clear public governance model that empowered open-source contributors. New systems must include governance structures that are transparent, accountable, and representative of global stakeholders — including open-source projects, civil society, and international contributors. Formalize open governance around vulnerability disclosure. The CVE program lacked a clear public governance model that empowered open-source contributors. New systems must include governance structures that are transparent, accountable, and representative of global stakeholders — including open-source projects, civil society, and international contributors. Formalize open governance around vulnerability disclosure. Pressure policymakers to treat vulnerability management as critical infrastructure. Coordinated vulnerability disclosure is not a peripheral function. It is foundational to national and global cybersecurity. Advocacy is urgently needed to reframe CVE as a public safety utility that deserves permanent, nonpartisan support — not an expendable budget line. Pressure policymakers to treat vulnerability management as critical infrastructure. Coordinated vulnerability disclosure is not a peripheral function. It is foundational to national and global cybersecurity. Advocacy is urgently needed to reframe CVE as a public safety utility that deserves permanent, nonpartisan support — not an expendable budget line. Pressure policymakers to treat vulnerability management as critical infrastructure. Support a community-led security trust layer. As vulnerabilities proliferate across software supply chains, we need a public, community-owned infrastructure for assigning, verifying, and distributing vulnerability information. This may include the federation of trusted assigners, integration with SBOMs, and standardized APIs for tooling.
Regulatory Fallout: CVE Loss Meets EU Cyber Resilience Act
The implications of CVE’s defunding are magnified by the regulatory shifts now underway with the European Union’s Cyber Resilience Act (CRA). Finalized in early 2024 and entering into effect over the next two years, the CRA introduces mandatory vulnerability handling and disclosure requirements for digital products placed on the European market. This includes explicit obligations for software producers — including open-source maintainers in some cases — to track, report, and remediate vulnerabilities under strict timelines.
These obligations depend on the very infrastructure that CVE provided.The CRA’s requirements hinge on accurate vulnerability identification, consistent metadata, and traceable timelines from disclosure to mitigation. Without a globally recognized vulnerability ID system like CVE, many companies and maintainers will struggle to meet these compliance demands. The fragmentation of vulnerability data sources could result in delays or discrepancies in CRA reporting, increasing the risk of penalties, liability, and reputational damage.Moreover, the CRA encourages regulators and product security incident response teams (PSIRTs) to rely on existing standards and tooling — most of which have been built around CVE and its integrations. Without continuity in these systems, organizations may need to rebuild compliance workflows from scratch, including re-validating SBOM entries, rebuilding security advisories, and integrating with new, potentially untested vulnerability databases.There is a real risk that in trying to enhance cybersecurity through regulatory pressure, the EU’s own enforcement infrastructure may be undermined by the sudden loss of one of its foundational data sources. Unless mitigation efforts are prioritized, companies operating in both U.S. and EU jurisdictions may find themselves caught between regulatory expectations and the collapse of the very system that enabled compliance. Support a community-led security trust layer. As vulnerabilities proliferate across software supply chains, we need a public, community-owned infrastructure for assigning, verifying, and distributing vulnerability information. This may include the federation of trusted assigners, integration with SBOMs, and standardized APIs for tooling. Support a community-led security trust layer. Regulatory Fallout: CVE Loss Meets EU Cyber Resilience Act The implications of CVE’s defunding are magnified by the regulatory shifts now underway with the European Union’s Cyber Resilience Act (CRA). Finalized in early 2024 and entering into effect over the next two years, the CRA introduces mandatory vulnerability handling and disclosure requirements for digital products placed on the European market. This includes explicit obligations for software producers — including open-source maintainers in some cases — to track, report, and remediate vulnerabilities under strict timelines. Cyber Resilience Act (CRA) These obligations depend on the very infrastructure that CVE provided. The CRA’s requirements hinge on accurate vulnerability identification, consistent metadata, and traceable timelines from disclosure to mitigation. Without a globally recognized vulnerability ID system like CVE, many companies and maintainers will struggle to meet these compliance demands. The fragmentation of vulnerability data sources could result in delays or discrepancies in CRA reporting, increasing the risk of penalties, liability, and reputational damage. Moreover, the CRA encourages regulators and product security incident response teams (PSIRTs) to rely on existing standards and tooling — most of which have been built around CVE and its integrations. Without continuity in these systems, organizations may need to rebuild compliance workflows from scratch, including re-validating SBOM entries, rebuilding security advisories, and integrating with new, potentially untested vulnerability databases. There is a real risk that in trying to enhance cybersecurity through regulatory pressure, the EU’s own enforcement infrastructure may be undermined by the sudden loss of one of its foundational data sources. Unless mitigation efforts are prioritized, companies operating in both U.S. and EU jurisdictions may find themselves caught between regulatory expectations and the collapse of the very system that enabled compliance. Final Thoughts The termination of CVE funding is more than a policy failure. It is an inflection point in how we understand digital risk. If we treat security intelligence as disposable, we should not be surprised when breaches become normalized. The CVE system allowed engineers to speak the same language about risk. It gave defenders the time and tools to act. Without it, we lose not just a dataset — we lose our map of the terrain. The road ahead must be paved by the community, for the community. We cannot rely on unstable government funding to maintain the most critical systems that protect our digital future. If we treat security intelligence as disposable, we should not be surprised when breaches become normalized. This is a quick post to get awareness out; I’ll write a more in-depth analysis and protocol for vulnerability coverage as this develops. If this event teaches us anything, it is this: cybersecurity cannot be outsourced, and safety cannot be paused.

The Collapse of CVE: How a Funding Failure Threatens Global Cybersecurity

Like many students, I do not enjoy scrolling through endless PDFs. I would if I could skip reading and just ask my textbook questions. So, naturally, I did what any lazy-but-resourceful person would do: I dumped the entire PDF into an LLM and started asking questions, praying to God that the answers were accurate. do not Spoiler alert: they weren’t. The answers were either vague, wrong, or just plain confusing. That’s when I realized — large language models aren’t magic (shocking, I know). They have context limits, and stuffing a whole book into one prompt is like trying to fit a watermelon into a ziplock bag. context limits So I started digging, and that’s when I found the real MVP: RAG (Retrieval-Augmented Generation). With RAG, instead of force-feeding the model everything, you teach it where to look — and suddenly, answers start making sense RAG (Retrieval-Augmented Generation) where Why Large Context Windows Don’t Really Help (Much) Why Large Context Windows Don’t Really Help (Much) You might think, “Wait… but newer models have massive context windows, right? Shouldn’t that fix the problem?” In theory? Yes. In practice? Meh. Even with context windows stretching up to 100k tokens (which sounds huge), you're still working with trade-offs: They’re expensive to use.


They often truncate or compress information.


And unless your prompt is perfectly structured (which is rarely the case), the model still ends up hallucinating or giving generic responses. They’re expensive to use. They’re expensive to use. They often truncate or compress information. They often truncate or compress information. And unless your prompt is perfectly structured (which is rarely the case), the model still ends up hallucinating or giving generic responses. And unless your prompt is perfectly structured (which is rarely the case), the model still ends up hallucinating or giving generic responses. It’s like asking your friend to remember every word of a 300-page book and hoping they don’t mess up the details. Not ideal. RAG to the Rescue RAG to the Rescue RAG — Retrieval-Augmented Generation — is like giving your LLM a cheat sheet… but a really smart, targeted one. RAG — Retrieval-Augmented Generation — is like giving your LLM a cheat sheet… but a really smart, targeted one. Here’s the flow: Here’s the flow: You split your book into smaller chunks
You store these chunks in a vector DB.
When a user asks a question, you don’t give the model the entire book — just the most relevant parts.
Then the LLM crafts a solid, informed answer using onlythose parts. You split your book into smaller chunks You store these chunks in a vector DB. When a user asks a question, you don’t give the model the entire book — just the most relevant parts. entire most relevant parts Then the LLM crafts a solid, informed answer using onlythose parts. only Less noise. More signal. Way better answers. What Does the RAG Pipeline Look Like? What Does the RAG Pipeline Look Like? Imagine you’re the middleman between your textbook and your model. Your job is to: Your job is to: Split the content → Break the book into readable chunks


Convert them into vectors → Using an embedding model (Cohere)


Save those vectors → In a vector database (Pinecone)


When a question is asked:

Convert the question into a vector
Search the database for chunks that are most similar (using cosine distance metric)
Send the best matches + the question to a language model (I used Gemini)
Boom — you get a clear, helpful answer Split the content → Break the book into readable chunks Split the content → Break the book into readable chunks Convert them into vectors → Using an embedding model (Cohere) Convert them into vectors → Using an embedding model (Cohere) Save those vectors → In a vector database (Pinecone) Save those vectors → In a vector database (Pinecone) When a question is asked:

Convert the question into a vector
Search the database for chunks that are most similar (using cosine distance metric)
Send the best matches + the question to a language model (I used Gemini)
Boom — you get a clear, helpful answer When a question is asked: Convert the question into a vector
Search the database for chunks that are most similar (using cosine distance metric)
Send the best matches + the question to a language model (I used Gemini)
Boom — you get a clear, helpful answer Convert the question into a vector Search the database for chunks that are most similar (using cosine distance metric) Send the best matches + the question to a language model (I used Gemini) Boom — you get a clear, helpful answer And that’s the heart of it. You’re not replacing the model’s brain — just giving it better memory. My Stack: Simple, Powerful, Beginner-Friendly My Stack: Simple, Powerful, Beginner-Friendly Here’s what I used: 🧠 Cohere – To turn both book content and questions into vectors (aka embeddings)
📦 Pinecone – To store and search those vectors super efficiently
💬 Gemini – To generate the final, natural-language response 🧠 Cohere – To turn both book content and questions into vectors (aka embeddings) 🧠 Cohere – 📦 Pinecone – To store and search those vectors super efficiently 📦 Pinecone – 💬 Gemini – To generate the final, natural-language response 💬 Gemini – You don’t have to use these, but this combo is beginner-friendly, well-documented, and plays nicely together. have Step-by-Step: Build Your Own AskMyBook Bot Step-by-Step: Build Your Own AskMyBook Bot Okay, let’s actually build the thing now. I used Google Colab (because free GPU and easy sharing), but this should work in any Python environment. Okay, let’s actually build the thing now. I used Google Colab (because free GPU and easy sharing), but this should work in any Python environment. Step 1: Load and Chunk Your Book Step 1: Load and Chunk Your Book I used the PyMuPDF library to extract text. I used the PyMuPDF library to extract text. !pip install pymupdf !pip install pymupdf Now, let’s extract the text: Now, let’s extract the text: import fitz  # PyMuPDF

def extract_text_from_pdf(pdf_path):

    doc = fitz.open(pdf_path)

    text = ""

    for page in doc:

        text += page.get_text()

    return text 

book_path = 'enter the path here'

book_text = extract_text_from_pdf(book_path) import fitz  # PyMuPDF

def extract_text_from_pdf(pdf_path):

    doc = fitz.open(pdf_path)

    text = ""

    for page in doc:

        text += page.get_text()

    return text 

book_path = 'enter the path here'

book_text = extract_text_from_pdf(book_path) Now, we’ll split the book into chunks, making it more digestible. import re

def chunk_text(text, chunk_size=300, overlap=50):

    words = re.findall(r'\S+', text)

    chunks = []

    for i in range(0, len(words), chunk_size - overlap):

        chunk = ' '.join(words[i:i + chunk_size])

        chunks.append(chunk)

    return chunks

chunks = chunk_text(book_text)

print(f"Total Chunks: {len(chunks)}")

print("Sample chunk:\n", chunks[0]) import re

def chunk_text(text, chunk_size=300, overlap=50):

    words = re.findall(r'\S+', text)

    chunks = []

    for i in range(0, len(words), chunk_size - overlap):

        chunk = ' '.join(words[i:i + chunk_size])

        chunks.append(chunk)

    return chunks

chunks = chunk_text(book_text)

print(f"Total Chunks: {len(chunks)}")

print("Sample chunk:\n", chunks[0]) Here, each chunk has 300 words, with a 50-word overlap for context continuity. Think of it as giving the model a smooth flow between paragraphs. Step 2: Create Embeddings with Cohere Embeddings = turning text into numbers that reflect meaning. We’ll use Cohere's embed-english-v3.0 model for this. !pip install cohere

import cohere

co = cohere.Client("YOUR-API-KEY")  # Replace with your actual key

def get_embeddings(texts):

    response = co.embed(

        texts=texts,

        model="embed-english-v3.0",

        input_type="search_document"

    )

    return response.embeddings !pip install cohere

import cohere

co = cohere.Client("YOUR-API-KEY")  # Replace with your actual key

def get_embeddings(texts):

    response = co.embed(

        texts=texts,

        model="embed-english-v3.0",

        input_type="search_document"

    )

    return response.embeddings Step 3: Store Chunks in Pinecone Now we store the embeddings in Pinecone — a vector database that helps us search similar chunks later. !pip install pinecone

import pinecone

pinecone = pinecone.Pinecone(api_key="YOUR-API-KEY")

index_name = "ask-my-book"

if index_name not in pinecone.list_indexes().names():

    pinecone.create_index(

        index_name,

        spec={

            "pod": {

                "pod_type": "p1",

                "replicas": 1,

                "metric": "cosine",

                "environment": "aws-us-east1"

            }

        },

        dimension=1024

    )

index = pinecone.Index(index_name) !pip install pinecone

import pinecone

pinecone = pinecone.Pinecone(api_key="YOUR-API-KEY")

index_name = "ask-my-book"

if index_name not in pinecone.list_indexes().names():

    pinecone.create_index(

        index_name,

        spec={

            "pod": {

                "pod_type": "p1",

                "replicas": 1,

                "metric": "cosine",

                "environment": "aws-us-east1"

            }

        },

        dimension=1024

    )

index = pinecone.Index(index_name) Now, batch upload the chunks import uuid

import time

batch_size = 96 

for i in range(0, len(chunks), batch_size):

    batch_chunks = chunks[i:i+batch_size]

    batch_embeds = get_embeddings(batch_chunks)

    ids = [str(uuid.uuid4()) for _ in batch_chunks]

    vectors = list(zip(ids, batch_embeds, [{"text": t} for t in batch_chunks]))

    index.upsert(vectors=vectors)

    time.sleep(60)  # avoid hitting rate limits import uuid

import time

batch_size = 96 

for i in range(0, len(chunks), batch_size):

    batch_chunks = chunks[i:i+batch_size]

    batch_embeds = get_embeddings(batch_chunks)

    ids = [str(uuid.uuid4()) for _ in batch_chunks]

    vectors = list(zip(ids, batch_embeds, [{"text": t} for t in batch_chunks]))

    index.upsert(vectors=vectors)

    time.sleep(60)  # avoid hitting rate limits Boom! Your book is now smartly stored in vector format. Step 4: Ask Questions + Get Answers with Gemini We’ll search for relevant chunks using your query, and then pass those to Gemini for generating an answer. First, get the query embedding: def get_query_embedding(query):

    response = co.embed(

        texts=[query],

        model="embed-english-v3.0",

        input_type="search_query"

    )

    return response.embeddings[0] def get_query_embedding(query):

    response = co.embed(

        texts=[query],

        model="embed-english-v3.0",

        input_type="search_query"

    )

    return response.embeddings[0] Now, search Pinecone: def search_similar_chunks(query, top_k=5):

    query_embedding = get_query_embedding(query)

    result = index.query(vector=query_embedding, top_k=top_k, include_metadata=True)

    return [match['metadata']['text'] for match in result['matches']] def search_similar_chunks(query, top_k=5):

    query_embedding = get_query_embedding(query)

    result = index.query(vector=query_embedding, top_k=top_k, include_metadata=True)

    return [match['metadata']['text'] for match in result['matches']] Then plug the top chunks into Gemini: import google.generativeai as genai

genai.configure(api_key="YOUR-GEMINI-API-KEY")

model = genai.GenerativeModel("gemini-1.5-flash")

def generate_answer(query):

    context_chunks = search_similar_chunks(query)

    context = "\n\n".join(context_chunks)

    prompt = f"""

You are an assistant bot trained on the following book content. Use only the info provided to answer the user's question.

Book Context:

{context}

Question:

{query}

If the question is not relevant to the context, respond with:

'I am a bot trained to answer questions based on the book content. This question is out of scope.'

"""

    response = model.generate_content(prompt)

    return response.text import google.generativeai as genai

genai.configure(api_key="YOUR-GEMINI-API-KEY")

model = genai.GenerativeModel("gemini-1.5-flash")

def generate_answer(query):

    context_chunks = search_similar_chunks(query)

    context = "\n\n".join(context_chunks)

    prompt = f"""

You are an assistant bot trained on the following book content. Use only the info provided to answer the user's question.

Book Context:

{context}

Question:

{query}

If the question is not relevant to the context, respond with:

'I am a bot trained to answer questions based on the book content. This question is out of scope.'

"""

    response = model.generate_content(prompt)

    return response.text Try it out! question = "What’s does the author say in Module 1 of the book?"

print(generate_answer(question)) question = "What’s does the author say in Module 1 of the book?"

print(generate_answer(question)) That’s It — You Now Have an Ask-My-Book Bot! You built a bot that: Understands your textbook
Finds the right part when asked
Gives meaningful answers using that part only Understands your textbook Finds the right part when asked Gives meaningful answers using that part only No more endless skimming. Just type and ask. What Next? Level Up Your Book-Bot What we’ve built is a basic but powerful Question-and-Answer system. Think of it as the MVP (Minimum Viable Product) of your personal study assistant. But once you’re comfortable, there’s so much more you can add: Citations – Show which chunk or page the answer came from, so you can verify the source.
Multi-turn Conversations – Let the bot remember previous questions and give more intelligent answers over time.
Multi-step Reasoning – Chain thoughts together to answer complex questions.
Custom Memory – Let your bot hold on to important facts you highlight for future queries.
UI Upgrade – Hook this into a Streamlit or React frontend for a polished, user-friendly experience. Citations – Show which chunk or page the answer came from, so you can verify the source. Multi-turn Conversations – Let the bot remember previous questions and give more intelligent answers over time. Multi-step Reasoning – Chain thoughts together to answer complex questions. Custom Memory – Let your bot hold on to important facts you highlight for future queries. UI Upgrade – Hook this into a Streamlit or React frontend for a polished, user-friendly experience. With these, your bot goes from “smart textbook” to “AI study buddy.” If you’ve ever stared at a textbook, praying it would just talk back and tell you what matters — well, now it can. talk back This was my little experiment in turning boring PDFs into interactive conversations. Hope it inspires you to build your own and maybe even customize it for friends or classes. Got stuck somewhere? Want help with adding a UI or citations next? Drop a comment or ping me — always happy to chat.

Tired of Digging Through Long PDFs? You Can Build a Bot That Can Quickly Answer Questions for You

How Not to Mess Up Your AI Build (and Actually Save Time) How Not to Mess Up Your AI Build (and Actually Save Time) We're in the era of AI. Every company wants to add some kind of AI feature to their product. LLMs (large language models) are popping up everywhere - some are even building their own. But while everyone's jumping into the hype, I just want to share a few things I've learned after working with LLMs across different projects over the past year. 1. Pick the Right Model for the Right Job 1. Pick the Right Model for the Right Job One big mistake I've seen (and made) is assuming all LLMs are equal. They're not. Some models have way more knowledge about certain locations or domains (Gemini is great at some areas where OpenAI models don't perform well). Some are good at reasoning but slow. Others are fast but bad at critical thinking. Each model has its own strengths. Use OpenAI GPT-4 for deep reasoning tasks. Use Claude or Gemini for other areas depending on how they've been trained. Models like Gemini Flash are optimized for speed, but they tend to skip deeper reasoning. The bottom line: Don't use one model for everything. Be intentional. Try, test, and pick the best one for your use case. The bottom line: 2. Don't Expect LLMs to Do All the Thinking 2. Don't Expect LLMs to Do All the Thinking I used to believe you could just throw a prompt at an LLM, and it would do all the heavy lifting. For example, I was working on a project where users selected their favorite teams, and the app had to generate a match-based travel itinerary. At first, I thought I could just send the whole match list to the LLM and expect it to pick the best ones and build the itinerary. It didn't work. It was slow, messy, and unreliable. So I changed the approach: the system picks the right matches first, then passes only the relevant ones to the LLM to generate the itinerary. That worked much better. Lesson? Let your app handle the logic. Use LLMs to generate things, not to decide everything. They're great at language; not always great at logic, at least for now. Lesson? 3. Give Each Agent One Responsibility 3. Give Each Agent One Responsibility Trying to make a single LLM do multiple jobs is a recipe for confusion. In one of my projects, I had a supervisor agent that routed messages to different specialized agents based on user input. Initially, I added too much logic to it - handling context, figuring out follow-ups, deciding continuity, etc. It eventually got confused and made the wrong calls. So, I split it up. I moved some logic (like thread continuity) outside and kept the supervisor focused only on routing. After that, things became much more stable. Lesson: Don't overload your agents. Keep one responsibility per agent. This helps reduce hallucinations and improves reliability. Lesson: 4. Latency Is Inevitable  -  Use Streaming 4. Latency Is Inevitable  -  Use Streaming LLMs that are good at reasoning are usually slow. That's just the reality right now. Some models like GPT-4 or Claude 2 take their time, especially with complex prompts. You can't fully eliminate the delay, but you can make it feel better for the user. One way to do that? Stream the output as it's generated. Most LLM APIs support text streaming, allowing you to start sending partial responses - even sentence by sentence - while the rest is still being processed. In my apps, I stream whatever's ready to the client as soon as it's available. It gives users a sense of progress, even if the full result takes a bit longer. Lesson: You can't avoid latency, but you can hide it. Stream early, stream often - even partial output makes a big difference in perceived speed. Lesson: 5. Fine-Tuning Can Save You Time (and Tokens) 5. Fine-Tuning Can Save You Time (and Tokens) People often avoid fine-tuning because it seems complex or expensive. But in some cases, it actually saves a lot. If your prompts need to include the same structure or context every time and caching doesn't help, you're spending extra tokens and time. Instead, just fine-tune the model with that structure. After that, you don't need to pass the same example every time - it just knows what to do. But be careful: don't fine-tune on data that changes frequently, like flight times or prices. You'll end up teaching the model outdated information. Fine-tuning works best when the logic and format are stable. Lesson: Fine-tune when things are consistent - not when they're constantly changing. It saves effort in the long run and leads to faster, cheaper prompts. Lesson: 🎯 Final Thoughts Working with LLMs is not just about prompts and APIs. It's about architecture, performance, clarity, and most importantly, knowing what to expect (and what not to expect) from these models. Hope this helps someone out there building their next AI feature.

Stories, News & Mentions about CONTINUITY

Categories

Trending Topics

Stories, News & Mentions about CONTINUITY

Continuity’s Stories on HackerNoon

Continuity's News & Mentions

Categories

Trending Topics