Inside the Palantir Mafia: Startups That Are Quietly Shaping the Future

By Ramkumar Sundarakalatharan | March 24, 2025 | Comments 0 Comment

Inside the Palantir Mafia: Recent Moves, New Players, and Unwritten Rules

(Part 2: 2023–2025 Update)

I. Introduction: The Palantir Mafia Evolves

The “Palantir Mafia” has quietly become one of the most influential networks in the tech world, rivalling even the legendary PayPal Mafia. Since our last deep dive, this group of alumni from the data analytics giant has continued to reshape industries, launch groundbreaking startups, and redefine how technology intersects with defence, AI, and beyond.

In this update, we’ll explore recent developments, decode the playbooks that drive their success, and unveil the shadow curriculum that seems to guide every Palantir alum’s journey.

II. Deep Dive: Updates on Key Figures and Their Companies

1. Palmer Luckey (Anduril Industries) (or the Elon Musk of GenZ)

Original Focus: AI-powered defence infrastructure (e.g., autonomous drones, sensor networks).
2023–2025 Developments:

$12B Valuation (2024): Anduril secured a $1.5B Series E led by Valor Equity Partners, doubling its valuation to $12B.
Lattice for NATO: Deployed its Lattice OS across NATO members for real-time battlefield analytics, a direct evolution of Palantir’s Gotham platform.
Controversy: Faced scrutiny for supplying AI surveillance systems to conflict zones like Sudan, sparking debates about autonomous weapons ethics.
Future Outlook: Anduril is poised to dominate the $200B defence tech market, with plans to expand into AI-driven logistics for the Pentagon.

2. Mati Staniszewski (ElevenLabs)

Original Focus: Voice cloning and synthetic media.
2023–2025 Developments:

$1.4B Unicorn Status (2023): Raised $80M Series B from a16z, reaching a $1.4B valuation.
Hollywood Adoption: Partnered with Netflix to dub shows into 20+ languages using AI voices indistinguishable from humans.
Ethics Overhaul: Launched “Voice Integrity” tools to combat deepfakes after backlash over misuse in elections.

3. Leigh Madden (Epirus)

Original Focus: Counter-drone microwave technology.
2023–2025 Developments:

DoD Contracts: Won $300M in Pentagon contracts to deploy its Leonidas system in Ukraine and Taiwan.
SPAC Exit: Merged with a blank-check company in 2024, valuing Epirus at $5B.

III. New Mafia Members: Emerging Stars from Palantir

Key Statistics

31% of 170+ Palantir-founded startups launched since 2020, with a surge in AI, defence tech, and data infrastructure ventures.
$10 Braised in the past 3 years by alumni startups, bringing total funding to $24B.
15% of startups have gone through Y Combinator, while firms like Thrive Capital and a16z lead investments.

Company Name	Founder(s)	Funding	Sector	Significant Achievements/Milestones
Arondite	Will Blyth, Rob Underhill	Undisclosed pre-seed (2024)	Defense Tech	Released AI platform Cobalt; won defense contracts
Bastion	Arnaud Drizard, Robin Costé, Sebastien Duc	€2.5M seed (2023)	Security & Compliance	Profitable, preparing for 2025 Series A
Ankar AI	Wiem Gharbi, Tamar Gomez	Seed (2024)	AI Tools for R&D	AI patent research tools adopted by EU tech firms
Fern Labs	Ash Edwards, Taylor Young, Alex Goddijn	$3M pre-seed (2024)	AI Automation	Developed open-ended process automation agents
Ferry	Ethan Waldie, Dominic Aits	Seed (2023)	Digital Manufacturing	Deployed in Fortune 500 manufacturers
Wondercraft	Dimitris Nikolaou, Youssef Rizk	$3M (2024)	AI Audio	Built on ElevenLabs’ tech; YC-backed
Ameba	Craig Massie	$8.8M total (2023)	Supply Chain Data	Raised $7.1M seed led by Hedosophia
DataLinks	Francisco Ferreira, Andrzej Grzesik	Undisclosed (2024)	Data Integration	Connects enterprise reports with live datasets

IV. Decoded: Playbooks from the Palantir Diaspora

Palantir alumni have developed a distinct set of playbooks that guide their ventures, many of which are reshaping industries. Here are the key frameworks:

1. First-Principles Problem-Solving

At Palantir, solving problems from first principles wasn’t just encouraged—it was a mandate. Alumni carry this mindset into their startups, breaking down complex challenges into fundamental truths and rebuilding solutions from scratch.

Example: Anduril’s Palmer Luckey applied first-principles thinking to reimagine defense technology, creating autonomous systems that are faster, cheaper, and more effective than traditional military solutions.

2. Talent Density Obsession

Palantir alumni believe in hiring not just good people but exceptional ones—and then creating an environment where they can thrive.

Lesson: “A small team of A+ players can outperform a massive team of B players.” Startups like Founders Fund-backed Resilience show how a high-talent density can accelerate innovation in biotech.

3. Operational Security from Day 1

Security isn’t an afterthought for Palantir alumni—it’s baked into their DNA. Whether it’s protecting sensitive data or safeguarding intellectual property, operational security is treated as core to product development.

Example: Alumni-founded startups like Bastion prioritize cybersecurity as a foundational element rather than a feature to be added later.

4. Fundraising via Narrative + Network Leverage

Palantir alumni are masters at crafting compelling narratives for investors and leveraging their networks to secure funding. They don’t just pitch products—they sell visions of transformative change.

Case Study: ElevenLabs’ ability to articulate its vision for AI-driven voice technology helped secure its $80M Series B and unicorn status.

V. From Palantir to Power: What Startups Can Learn from the Mafia Effect

1. Internal Culture: Building for Resilience

Palantir alumni understand that culture isn’t just about perks or values on a wall—it’s about creating an environment where people can do their best work under pressure.

Takeaway: Build cultures that encourage radical candor, intellectual rigor, and relentless execution.

2. Zero-to-One Mindsets

Borrowing from Peter Thiel’s famous philosophy, Palantir alumni excel at identifying opportunities where they can create something entirely new rather than iterating on what already exists.

Example: Fern Labs is redefining enterprise workflow automation with AI agents, described as “Palantir’s spiritual successor for AI ops” by Sifted.

3. Strategic Hiring: The Right People at the Right Time

Palantir alumni know that hiring decisions can make or break an early-stage startup. They focus on bringing in people who not only have exceptional skills but also align deeply with the company’s mission.

4. Geopolitical Awareness: Building with Context

Working at Palantir required navigating complex geopolitical landscapes and understanding how technology intersects with policy and power structures. Alumni bring this awareness into their startups.

Lesson for Emerging Markets: Founders should consider how their products fit into larger geopolitical or regulatory frameworks.

Example: Anduril’s Taiwan Strategy: Mirroring Palantir’s government work, Anduril embedded engineers with Taiwan’s military to co-develop counter-invasion AI models.

VI. The Shadow Curriculum: Lessons No One Teaches but Everyone from Palantir Seems to Know

Lesson 1: “Don’t Be the Smartest Person in the Room”

At Palantir, success wasn’t about individual brilliance—it was about creating environments where teams could collectively solve problems better than any one person could alone.

Takeaway: As a founder or leader, focus on making others sharper rather than proving your own intelligence.

Lesson 2: “Security Is Product—Treat It Like UX”

For Palantirians, security isn’t just a backend concern; it’s integral to user experience. This mindset has influenced how alumni design systems that are both secure and user-friendly.

Example: Startups like Bastion embed security directly into their compliance platforms.

Lesson 3: “Think Like an Operator”

Whether it’s scaling teams or managing crises, Palantir alumni approach challenges with an operator’s mindset—focused on execution and outcomes rather than abstract strategy.

Lesson 4: “Operate Like a Spy”

Palantirians treat corporate strategy like intelligence ops.

Example: ElevenLabs’ Stealth Pivot: Staniszewski quietly shifted from consumer apps to enterprise contracts after discovering government interest in voice cloning—a tactic learned from Palantir’s classified project shifts.

Lesson 5: “Build Coalitions, Not Just Products”

Anduril’s Luckey lobbied Congress to pass the AI Defense Act of 2024, leveraging Palantir’s network of ex-DoD contacts.

VII. Engineering Influence: Mapping the Palantir Alumni’s Quiet Takeover of Tech

The influence of Palantir alumni extends far beyond their own ventures—they’ve quietly infiltrated some of the most powerful roles in tech across various industries.

The Alumni Power Matrix

Sector	Key Alumni	Strategic Role
Defense Tech	Palmer Luckey (Anduril)	Board seats at Shield AI, Skydio
Fintech	Joe Lonsdale (Addepar)	Advisor to 8 Central Banks
AI/ML	Mati Staniszewski	NATO’s Synthetic Media Taskforce

Why Chiefs of Staff Rule: Ex-Palantir Chiefs of Staff now lead operations at SpaceX, OpenAI, and 15% of YC Top Companies—roles critical for scaling without losing operational security.

VIII. Conclusion: The Mafia’s Enduring Edge

The Palantir playbook—first principles, talent density, and geopolitical savvy—has become the gold standard for startups aiming to dominate regulated industries. As alumni like Luckey and Staniszewski redefine defense and AI, their shadow curriculum offers a masterclass in building companies that don’t just adapt to the future—they engineer it.

The “Palantir Mafia” isn’t just reshaping industries—it’s redefining how startups operate at every level, from culture to strategy to execution. For founders looking to emulate their success, the lessons are clear: think deeply, hire strategically, build securely, and always operate with clarity of purpose.

As this diaspora continues to grow, its influence will only deepen—quietly engineering the next wave of transformative companies across tech and beyond.

References & Further Reading

Forbes. (2024). “Anduril’s $12B Valuation Marks Defense Tech’s Ascendance”
Reuters. (2023). “NATO Adopts Anduril’s Lattice OS”
TechCrunch. (2023). “ElevenLabs raises $80M at $1.4B valuation for AI-powered voice cloning and synthesis”
Code Execution Dataset. (2025). Internal analysis of Palantir alumni ventures.
New Economies. (2024). “Startup Factories: Palantir”
Sifted. (2025). “19 Former Palantir Employees Now Heading Up Startups”
Prince Chhirolya, LinkedIn. (2024). “Palantir Alumni Network Analysis”
John Kim, LinkedIn. (2024). “Why Palantir Technologies Alumni Are Great Founders”
Wall Street Journal. (2024). “Anduril’s AI-Powered Defense Systems Gain Traction in Taiwan”
The Information. (2024). “Inside ElevenLabs’ Pivot to Enterprise AI”
Politico. (2024). “Tech Founders Lobby for AI Defense Act”
TechCrunch. (2025). “Why Palantir Chiefs of Staff Are in Demand”

Is Oracle Cloud Safe? Data Breach Allegations and What You Need to Do Now

By Ramkumar Sundarakalatharan | March 22, 2025 | Comments 0 Comment

A strange sense of déjà vu is sweeping through the cybersecurity community. A threat actor claims to have breached Oracle Cloud’s federated SSO infrastructure, making off with over 6 million records. Oracle, in response, says in no uncertain terms: nothing happened. No breach. No lost data. No story.

But is that the end of it? – Not quite.

Security professionals have learned to sit up and listen when there’s smoke—especially if the fire might be buried under layers of PR denial and forensic ambiguity. One of the earliest signals came from CloudSEK, a threat intelligence firm known for early breach warnings. Its CEO, Rahul Sasi, called it out plainly on LinkedIn:

“6M Oracle cloud tenant data for sale affecting over 140k tenants. Probably the most critical hack of 2025.”
Rahul Sasi, CEO, CloudSEK

The post linked to CloudSEK’s detailed blog, laying out the threat actor’s claims and early indicators. What followed has been a storm of speculation, technical analysis, and the uneasy limbo that follows when truth hasn’t quite surfaced.

The Claims: 6 Million Records, High-Privilege Access

A threat actor using the alias rose87168 appeared on BreachForums, claiming they had breached Oracle Cloud’s SSO and LDAP servers via a vulnerability in the WebLogic interface (login.[region].oraclecloud.com). According to CloudSEK (2025) and BleepingComputer (Cimpanu, 2025), here’s what they say they stole:

Encrypted SSO passwords
Java Keystore (JKS) files
Enterprise Manager JPS keys
LDAP-related configuration data
Internal key files associated with Oracle Cloud tenants

They even uploaded a text file to an Oracle server as “proof”—a small act that caught the eye of researchers. The breach, they claim, occurred about 40 days ago. And now, they’re offering to remove a company’s data from their sale list—for a price, of course.

It’s the kind of extortion tactic we’ve seen grow more common: pay up, or your internal secrets become someone else’s leverage.

Oracle’s Denial: Clear, Strong, and Unyielding

Oracle has pushed back—hard. Speaking to BleepingComputer, the company stated:

“There has been no breach of Oracle Cloud. The published credentials are not for the Oracle Cloud. No Oracle Cloud customers experienced a breach or lost any data.”

The message is crystal clear. But for some in the security world, perhaps too clear. The uploaded text file and detailed claim raised eyebrows. As one veteran put it, “If someone paints a map of your house’s wiring, even if they didn’t break in, you want to check the locks.”

The Uncomfortable Middle: Where Truth Often Lives

This is where things get murky. We’re left with questions that haven’t been answered:

How did the attacker upload a file to Oracle infrastructure?
Are the data samples real or stitched together from previous leaks?
Has Oracle engaged a third-party investigation?
Have any of the affected companies acknowledged a breach privately?

CloudSEK’s blog makes it clear that their findings rely on the attacker’s claims, not on validated internal evidence. Yet, when a threat actor provides partial proof—and others in the community corroborate small details—it becomes harder to simply dismiss the story.

Sometimes, truth emerges not from a single definitive statement, but from a pattern of smaller inconsistencies.

If It’s True: The Dominoes Could Be Serious

Let’s imagine the worst-case scenario for a moment. If the breach is real, here’s what’s at stake:

SSO Passwords and JKS Files: Could allow attackers to impersonate users and forge encrypted communications.
Enterprise Manager Keys: These could open backdoors into admin-level environments.
LDAP Info: A treasure trove for lateral movement within corporate networks.

When you’re dealing with cloud infrastructure used by over 140,000 tenants, even a tiny crack can ripple across ecosystems, affecting partners, vendors, and downstream customers.

And while we often talk about technical damage, it’s the reputational and compliance fallout that ends up costing more.

What Should Oracle Customers Do?

Until more clarity emerges, playing it safe is not just advisable—it’s essential.

Watch Oracle’s advisories and incident response reports
Review IAM logs and authentication anomalies from the past 45–60 days
Rotate keys, enforce MFA, audit third-party integrations
Enable enhanced threat monitoring for any Oracle Cloud-hosted applications
Coordinate internally on contingency planning—just in case this turns out to be real

Security teams are already stretched thin. But this is a “better safe than sorry” situation.

Final Thoughts: Insecurity in a Time of Conflicting Truths

We may not have confirmation of a breach. But what we do have is plausibility, opportunity, and an attacker who seems to know just enough to make us pause.

Oracle’s stance is strong and confident. But confidence is not evidence. Until independent investigators, third-party customers, or a whistleblower emerges, the rest of us are left piecing the puzzle together from threat intel, subtle details, and professional instinct.

“While we cannot definitively confirm a breach at this time, the combination of the threat actor’s claims, the data samples, and the unanswered questions surrounding the incident suggest that Oracle Cloud users should remain vigilant and take proactive security measures.”

For now, the best thing the community can do is watch, verify, and prepare—until the truth becomes undeniable.

References

CloudSEK, 2025. The biggest supply chain hack of 2025? 6M records for sale exfiltrated from Oracle Cloud affecting over 140k tenants. [online] CloudSEK. Available at: https://www.cloudsek.com/blog/the-biggest-supply-chain-hack-of-2025-6m-records-for-sale-exfiltrated-from-oracle-cloud-affecting-over-140k-tenants [Accessed 22 Mar 2025].
Cimpanu, C., 2025. Oracle denies data breach after hacker claims theft of 6 million data records. [online] BleepingComputer. Available at: https://www.bleepingcomputer.com/news/security/oracle-denies-data-breach-after-hacker-claims-theft-of-6-million-data-records [Accessed 22 Mar 2025].
CyberSecurity News, 2024. Hackers claim leak of Oracle data. [online] Available at: https://cybersecuritynews.com/hackers-claim-leak-of-oracle-data [Accessed 22 Mar 2025].
CNBCTV18, 2025. Oracle Cloud data breach: 6 million records exposed, says CloudSEK. [online] Available at: https://www.cnbctv18.com/technology/oracle-cloud-data-breach-6-million-records-exposed-cloudsek-19577542.htm [Accessed 22 Mar 2025].
Sasi, R., 2025. LinkedIn post on Oracle Cloud breach. [online] LinkedIn. Available at: https://www.linkedin.com/posts/rahulsasi_oracle-cloud-tenant-data-breach [Accessed 22 Mar 2025].

NIST selects HQC as the 5th Post-Quantum Algorithm: What you need to Know?

By Ramkumar Sundarakalatharan | March 19, 2025 | Comments 0 Comment

The Evolution of Post-Quantum Cryptography: NIST’s Fifth Algorithm Selection and Its Impact

Introduction

Quantum computing is no longer just a theoretical curiosity—it is advancing towards real-world applications. With these advances comes a major challenge: how do we keep our data secure when today’s encryption methods become obsolete?

Recognising this urgent need, the National Institute of Standards and Technology (NIST) has been working to standardise cryptographic algorithms that can withstand quantum threats. On March 11, 2025, NIST made a significant announcement: the selection of Hamming Quasi-Cyclic (HQC) as the fifth standardised post-quantum encryption algorithm. This code-based algorithm serves as a backup to ML-KEM (Module-Lattice Key Encapsulation Mechanism), ensuring that the cryptographic landscape remains diverse and resilient.

Business and Regulatory Implications

Why This Matters for Organisations

For businesses, governments, and security leaders, the post-quantum transition is not just an IT issue—it is a strategic necessity. The ability of quantum computers to break traditional encryption is not a question of if, but when. Organisations that fail to prepare may find themselves vulnerable to security breaches, regulatory non-compliance, and operational disruptions.

Key Deadlines & Compliance Risks

By 2030: NIST will deprecate all 112-bit security algorithms, requiring organisations to transition to quantum-resistant encryption.
By 2035: Quantum-vulnerable cryptography will be disallowed, meaning organisations must adopt new standards or risk compliance failures.
Government Mandates: The Cybersecurity and Infrastructure Security Agency (CISA) has already issued Binding Operational Directive 23-02, requiring federal vendors to begin their post-quantum transition.
EU Regulations: The European Union is advocating for algorithm agility, urging businesses to integrate multiple cryptographic methods to future-proof their security.

How Organisations Should Respond

To stay ahead of these changes, organisations should:

Implement Hybrid Cryptography: Combining classical and post-quantum encryption ensures a smooth transition without immediate overhauls.
Monitor Supply Chain Dependencies: Ensuring Software Bill-of-Materials (SBOM) compliance can help track cryptographic vulnerabilities.
Leverage Automated Tooling: NIST-recommended tools like Sigstore can assist in managing cryptographic transitions.
Pilot Test Quantum-Resistant Solutions: By 2026, organisations should begin hybrid ML-KEM/HQC deployments to assess performance and scalability.

Technical Breakdown: Understanding HQC and Its Role

Background: The NIST PQC Standardisation Initiative

Since 2016, NIST has been leading the effort to standardise post-quantum cryptography. The urgency stems from the fact that Shor’s algorithm, when executed on a sufficiently powerful quantum computer, can break RSA, ECC, and Diffie-Hellman encryption—the very foundations of today’s secure communications.

How We Got Here: NIST’s Selection Process

August 2024: NIST finalised its first three PQC standards:
- FIPS 203 – ML-KEM (for key exchange)
- FIPS 204 – ML-DSA (for digital signatures)
- FIPS 205 – SLH-DSA (for stateless hash-based signatures)
March 2025: NIST added HQC as a code-based backup to ML-KEM, ensuring an alternative in case lattice-based approaches face unforeseen vulnerabilities.

What Makes HQC Different?

HQC offers a code-based alternative to lattice cryptography, relying on quasi-cyclic codes and error-correction techniques.

Security Strength: HQC is based on the hardness of decoding random quasi-cyclic codes (QCSD problem). Its IND-CCA2 security is proven in the quantum random oracle model.
Efficient Performance:
- HQC offers a key size of ~3,000 bits, significantly smaller than McEliece’s ~1MB keys.
- It enables fast decryption while maintaining zero decryption failures in rank-metric implementations.
A Safety Net for Cryptographic Diversity: By introducing code-based cryptography, HQC provides a backup if lattice-based schemes, such as ML-KEM, prove weaker than expected.

Challenges & Implementation Considerations

Cryptographic Diversity & Risk Mitigation

Systemic Risk Reduction: A major breakthrough against lattice-based schemes would not compromise code-based HQC, ensuring resilience.
Regulatory Alignment: Many global cybersecurity frameworks now advocate for algorithmic agility, aligning with HQC’s role.

Trade-offs for Enterprises

Larger Key Sizes: HQC keys (~3KB) are larger than ML-KEM keys (~1.6KB), requiring more storage and processing power.
Legacy Systems: Organisations must modernise their infrastructure to support code-based cryptography.
Upskilling & Training: Engineers will need expertise in error-correcting codes, a different domain from lattice cryptography.

Looking Ahead: Preparing for the Post-Quantum Future

Practical Next Steps for Organisations

Conduct a Cryptographic Inventory: Use NIST’s PQC Transition Report to assess vulnerabilities in existing encryption methods.
Engage with Security Communities: Industry groups like the PKI Consortium and NIST Working Groups provide guidance on best practices.
Monitor Additional Algorithm Standardisation: Algorithms such as BIKE and Classic McEliece may be added in future updates.

Final Thoughts

NIST’s selection of HQC is more than just an academic decision—it is a reminder that cybersecurity is evolving, and businesses must evolve with it. The transition to post-quantum cryptography is not a last-minute compliance checkbox but a fundamental shift in how organisations secure their most sensitive data. Preparing now will not only ensure regulatory compliance but also protect against future cyber threats.

References & Further Reading

National Institute of Standards and Technology (2025) ‘NIST Selects HQC as Fifth Algorithm for Post-Quantum Encryption’, NIST Newsroom, [online]. Available at: https://www.nist.gov/news-events/news/2025/03/nist-selects-hqc-fifth-algorithm-post-quantum-encryption (Accessed: 18 March 2025).
SecurityWeek (2025) ‘NIST Announces HQC as Fifth Standardised Post-Quantum Algorithm’, SecurityWeek, [online]. Available at: https://www.securityweek.com/nist-announces-hqc-as-fifth-standardized-post-quantum-algorithm/ (Accessed: 18 March 2025).
MeriTalk (2025) ‘NIST Adds HQC as Fifth Algorithm for Post-Quantum Encryption’, MeriTalk, [online]. Available at: https://www.meritalk.com/articles/nist-adds-hqc-as-fifth-algorithm-for-post-quantum-encryption/ (Accessed: 18 March 2025).
Nocturnal Knight (2025) ‘Post-Quantum Cryptography Articles’, Nocturnal Knight, [online]. Available at: https://nocturnalknight.co/tag/post-quantum-cryptography/ (Accessed: 18 March 2025).
Nocturnal Knight (2025) ‘How Will China’s Quantum Advances Change Internet Security?’, Nocturnal Knight, [online]. Available at: https://nocturnalknight.co/how-will-chinas-quantum-advances-change-internet-security/ (Accessed: 18 March 2025).
PKI Consortium (2025) ‘NIST PQC Update’, PKI Consortium, [online].
Gaborit, P. (2024) ‘HQC: IND-CCA2 Code-Based Encryption’, Cryptographic Journal, [online].
OODA Loop (2025) ‘NIST Selects HQC as Backup Algorithm’, OODA Loop, [online].

Trump and Cyber Security: Did He Make Us Safer From Russia?

By Ramkumar Sundarakalatharan | March 7, 2025 | Comments 0 Comment

U.S. Cyber Warfare Strategy Reassessed: The Risks of Ending Offensive Operations Against Russia

Introduction: A Cybersecurity Gamble or a Diplomatic Reset?

Imagine a world where cyber warfare is not just the premise of a Bond movie or an episode of Mission Impossible, but a tangible and strategic tool in global power struggles. For the past quarter-century, cyber warfare has been a key piece on the geopolitical chessboard, with nations engaging in a digital cold war—where security agencies and military forces participate in a cyber equivalent of Mutually Assured Destruction (GovInfoSecurity). From hoarding zero-day vulnerabilities to engineering precision-targeted malware like Stuxnet, offensive cyber operations have shaped modern defence strategies (Loyola University Chicago).

Now, in a significant shift, the incoming Trump administration has announced a halt to offensive cyber operations against Russia, redirecting its focus toward China and Iran—noticeably omitting North Korea (BBC News). This recalibration has sparked concerns over its long-term implications, including the cessation of military aid to Ukraine, disruptions in intelligence sharing, and the broader impact on global cybersecurity stability. Is this a calculated move towards diplomatic realignment, or does it create a strategic void that adversaries could exploit? This article critically examines the motivations behind the policy shift, its potential repercussions, and its implications within the frameworks of international relations, cybersecurity strategy, and global power dynamics.

Russian Cyber Warfare: A Persistent and Evolving Threat

1.1 Russia’s Strategic Cyber Playbook

Russia has seamlessly integrated cyber warfare into its broader military and intelligence strategy, leveraging it as an instrument of power projection. Their approach is built on three key pillars:

Persistent Engagement: Russian cyber doctrine emphasises continuous infiltration of adversary networks to gather intelligence and disrupt critical infrastructure (Huskaj, 2023).
Hybrid Warfare: Cyber operations are often combined with traditional military tactics, as seen in Ukraine and Georgia (Chichulin & Kopylov, 2024).
Psychological and Political Manipulation: The use of cyber disinformation campaigns has been instrumental in shaping political narratives globally (Rashid, Khan, & Azim, 2021).

1.2 Case Studies: The Russian Cyber Playbook in Action

Several high-profile attacks illustrate the sophistication of Russian cyber operations:

The SolarWinds Compromise (2020-2021): This breach, attributed to Russian intelligence, infiltrated multiple U.S. government agencies and Fortune 500 companies, highlighting vulnerabilities in software supply chains (Vaughan-Nichols, 2021).
Ukraine’s Power Grid Attacks (2015-2017): Russian hackers used malware such as BlackEnergy and Industroyer to disrupt Ukraine’s energy infrastructure, showcasing the potential for cyber-induced kinetic effects (Guchua & Zedelashvili, 2023).
Election Interference (2016 & 2020): Russian hacking groups Fancy Bear and Cozy Bear engaged in data breaches and disinformation campaigns, altering political dynamics in multiple democracies (Jamieson, 2018).

These attacks exemplify how cyber warfare has been weaponised as a tool of statecraft, reinforcing Russia’s broader geopolitical ambitions.

The Trump Administration’s Pivot: From Russia to China and Iran

2.1 Reframing the Cyber Threat Landscape

The administration’s new strategy became evident when Liesyl Franz, the U.S. Deputy Assistant Secretary for International Cybersecurity, conspicuously omitted Russia from a key United Nations briefing on cyber threats, instead highlighting concerns about China and Iran (The Guardian, 2025). This omission marked a clear departure from previous policies that identified Russian cyber operations as a primary national security threat.

Similarly, the Cybersecurity and Infrastructure Security Agency (CISA) has internally shifted resources toward countering Chinese cyber espionage and Iranian state-sponsored cyberattacks, despite ongoing threats from Russian groups (CNN, 2025). This strategic reprioritisation raises questions about the nature of cyber threats and whether the U.S. may be underestimating the persistent risk posed by Russian cyber actors.

2.2 The Suspension of Offensive Cyber Operations

Perhaps the most controversial decision in this policy shift is U.S. Defence Secretary Pete Hegseth’s directive to halt all offensive cyber operations against Russia (ABC News).

3. Policy Implications: Weighing the Perspectives

3.1 Statement of Facts

The decision to halt offensive cyber operations against Russia represents a significant shift in U.S. cybersecurity policy. The official rationale behind the move is a strategic pivot towards addressing cyber threats from China and Iran while reassessing the cyber engagement framework with Russia.

3.2 Perceived Detrimental Effects

Critics argue that reducing cyber engagement with Russia may embolden its intelligence agencies and cybercrime syndicates. The Cold War’s history demonstrates that strategic de-escalation, when perceived as a sign of weakness, can lead to increased adversarial aggression. For instance, the 1979 Soviet invasion of Afghanistan followed a period of perceived Western détente (GovInfoSecurity). Similarly, experts warn that easing cyber pressure on Russia may enable it to intensify hybrid warfare tactics, including disinformation campaigns and cyber-espionage.

3.3 Perceived Advantages

Proponents of the policy compare it to Boris Yeltsin’s 1994 decision to detarget Russian nuclear missiles from U.S. cities, which symbolised de-escalation without dismantlement (Greensboro News & Record). Advocates argue that this temporary halt on cyber operations against Russia could lay the groundwork for cyber diplomacy and agreements similar to Cold War-era arms control treaties, reducing the risk of uncontrolled cyber escalation.

3.4 Overall Analysis

The Trump administration’s policy shift represents a calculated risk. While it opens potential diplomatic pathways, it also carries inherent risks of creating a security vacuum. Drawing lessons from Cold War diplomacy, effective deterrence must balance engagement with strategic restraint. Whether this policy fosters improved international cyber norms or leads to unintended escalation will depend on future geopolitical developments and Russia’s response.

References & Further Reading

ABC News (2025) Hegseth orders suspension of Pentagon’s offensive cyber operations against Russia. Available at: https://abcnews.go.com/Politics/wireStory/hegseth-orders-suspension-pentagons-offensive-cyberoperations-russia-119408032 (Accessed: 3 March 2025).
BBC News (2025) Understanding the U.S. cyber policy shift. Available at: https://www.bbc.com/news/articles/c2er34w0jgdo (Accessed: 4 March 2025).
Chichulin, N.A. and Kopylov, A.V. (2024) ‘The impact of cyber warfare on national security’, Society: Politics, Economics, Law, 11(1), pp. 20–26. Available at: http://dx.doi.org/10.24158/pep.2024.11.2 (Accessed: 5 March 2025).
GovInfoSecurity (2025) Cyber Cold War: U.S. vs Russia. Available at: https://www.govinfosecurity.com/blogs/cyber-cold-war-us-vs-russia-p-227 (Accessed: 2 March 2025).
Huskaj, G. (2023) Offensive cyberspace operations for cyber security. Available at: http://dx.doi.org/10.34190/iccws.18.1.1054 (Accessed: 1 March 2025).
Loyola University Chicago (2025) Cyber conflicts and international law. Available at: https://lawecommons.luc.edu/cgi/viewcontent.cgi?article=1214&context=pilr (Accessed: 6 March 2025).
Politico (2025) France has trouble understanding U.S. halt on cyber operations against Russia. Available at: https://www.politico.eu/article/france-has-trouble-understanding-us-halt-on-cyber-operations-against-russia/ (Accessed: 3 March 2025).
Rashid, A., Khan, A.Y., and Azim, S.W. (2021) ‘Cyber hegemony and information warfare: A case of Russia’, Liberal Arts and Social Sciences International Journal (LASSIJ), 5(1), pp. [insert page numbers]. Available at: http://dx.doi.org/10.47264/idea.lassij/5.1.42 (Accessed: 5 March 2025).
Vaughan-Nichols, S.J. (2021) SolarWinds: The more we learn, the worse it looks. ZDNet. Available at: https://www.zdnet.com/article/solarwinds-the-more-we-learn-the-worse-it-looks/ (Accessed: 2 March 2025).

UK And US Stand Firm: No New AI Regulation Yet. Here’s Why.

By Ramkumar Sundarakalatharan | February 22, 2025 | Comments 0 Comment

Introduction: A Fractured Future for AI?

Imagine a future where AI development is dictated by national interests rather than ethical, equitable, and secure principles. Countries scramble to outpace each other in an AI arms race, with no unified regulations to prevent AI-powered cyber warfare, misinformation, or economic manipulation.

This is not a distant dystopia—it is already happening.

At the Paris AI Summit 2025, world leaders attempted to set a global course for AI governance through the Paris Declaration, an agreement focusing on ethical AI development, cyber governance, and economic fairness (Oxford University, 2025). 61 nations, including France, China, India, and Japan, signed the declaration, signalling their commitment to responsible AI.

But two major players refused—the United States and the United Kingdom (Al Jazeera, 2025). Their refusal exposes a stark divide: should AI be a globally governed technology, or should it remain a tool of national dominance?

This article dissects the motivations behind the US and UK’s decision, explores the geopolitical and economic stakes in AI governance, and outlines the risks of a fragmented regulatory landscape. Ultimately, history teaches us that isolationism in global governance has dangerous consequences—AI should not become the next unregulated digital battleground.

The Paris AI Summit: A Bid for Global AI Regulation

The Paris Declaration set out six primary objectives (Anadolu Agency, 2025):

Ethical AI Development: Ensuring AI remains transparent, unbiased, and accountable.
International Cooperation: Encouraging cross-border AI research and investments.
AI for Sustainable Growth: Leveraging AI to tackle environmental and economic inequalities.
AI Security & Cyber Governance: Addressing the risks of AI-powered cyberattacks and disinformation.
Workforce Adaptation: Ensuring AI augments human labor rather than replacing it.
Preventing AI Militarization: Avoiding an uncontrolled AI arms race with autonomous weapons.

While France, China, Japan, and India supported the agreement, the US and UK abstained, each citing strategic, economic, and security concerns (Al Jazeera, 2025).

Why Did the US and UK Refuse to Sign?

1. The United States: Prioritizing National Interests

The US declined to sign the Paris Declaration due to concerns over national security and economic leadership (Oxford University, 2025). Vice President J.D. Vance articulated the administration’s belief in “pro-growth AI policies” to maintain the US’s dominance in AI innovation (Reuters, 2025).

The US government sees AI as a strategic asset, where global regulations could limit its control over AI applications in military, intelligence, and cybersecurity. This stance aligns with the broader “America First” approach, focusing on maintaining US technological hegemony over AI (Financial Times, 2025).

Additionally, the US has already weaponized AI chip supply chains, restricting exports of Nvidia’s AI GPUs to China to maintain its lead in AI research (Barron’s, 2024). AI is no longer just software—it’s about who controls the silicon powering it.

2. The United Kingdom: Aligning with US Policies

The UK’s refusal to sign reflects its broader strategy of maintaining the “Special Relationship” with the US, prioritizing alignment with Washington over an independent AI policy (Financial Times, 2025).

A UK government spokesperson stated that the declaration “had not gone far enough in addressing global governance of AI and the technology’s impact on national security.” This highlights Britain’s desire to retain control over AI policymaking rather than adhere to a multilateral framework (Anadolu Agency, 2025).

Additionally, the UK rebranded its AI Safety Institute as the AI Security Institute, signalling a shift from AI ethics to national security-driven AI governance (Economist, 2024). This move coincides with Britain’s ambition to protect ARM Holdings, one of the world’s most critical AI chip architecture firms.

By standing with the US, the UK secures:

Preferential access to US AI technologies.
AI defense collaboration with US intelligence agencies.
A strategic advantage over EU-style AI ethics regulations.

The AI-Silicon Nexus: Geopolitical and Commercial Implications

AI is Not Just About Software—It is a Hardware War

Control over AI infrastructure is increasingly centered around semiconductor dominance. Three companies dictate the global AI silicon supply chain:

TSMC (Taiwan) – Produces 90% of the world’s most advanced AI chips, making Taiwan a major geopolitical flashpoint (Economist, 2024).
Nvidia (United States) – Leads in designing AI GPUs, used for AI training and autonomous systems, but is now restricted from exporting to China (Barron’s, 2024).
ARM Holdings (United Kingdom) – Develops chip architectures that power AI models, yet remain aligned with Western tech and security alliances.

By controlling AI chips, the US and UK seek to slow China’s AI growth, while China accelerates efforts to achieve AI chip independence (Financial Times, 2025).

This AI-Silicon Nexus is now shaping AI governance, turning AI into a national security asset rather than a shared technology.

Lessons from History: The League of Nations and AI’s Fragmented Future

The US’s refusal to join the League of Nations after World War I weakened global security efforts, paving the way for World War II. Today, the US and UK’s reluctance to commit to AI governance could lead to an AI arms race—one that might spiral out of control.

Without a unified AI regulatory framework, adversarial nations can exploit gaps in governance, just as rogue states exploited international diplomacy failures in the 1930s.

The Risks of Fragmented AI Governance

Without global AI governance, the world faces serious risks:

Cybersecurity Vulnerabilities – Unregulated AI could fuel cyberwarfare, misinformation, and deepfake propaganda.
Economic Disruptions – Fragmented AI regulations will slow global AI adoption and cross-border investments.
AI Militarization – The absence of AI arms control policies could lead to autonomous warfare and digital conflicts.
Loss of Trust in AI – The lack of standardized AI safety frameworks could create regulatory chaos and ethical concerns.

Conclusion: A Call for Responsible AI Leadership

The Paris AI Summit has exposed deep divisions in AI governance, with the US and UK prioritizing AI dominance over global cooperation. Meanwhile, China, France, and other key players are using AI governance as a tool to shape global influence.

The world is at a critical crossroads—either nations cooperate to regulate AI responsibly, or they allow AI to become a fragmented, unpredictable force.

If history has taught us anything, isolationism in global security leads to arms races, geopolitical instability, and economic fractures. The US and UK must act before AI governance becomes an uncontrollable force—just as the failure of the League of Nations paved the way for war.

References

Global Disunity, Energy Concerns, and the Shadow of Musk: Key Takeaways from the Paris AI Summit
The Guardian, 14 February 2025.
https://www.theguardian.com/technology/2025/feb/14/global-disunity-energy-concerns-and-the-shadow-of-musk-key-takeaways-from-the-paris-ai-summit
Paris AI Summit: Why Did US, UK Not Sign Global Pact?
Anadolu Agency, 14 February 2025.
https://www.aa.com.tr/en/americas/paris-ai-summit-why-did-us-uk-not-sign-global-pact/3482520
Keir Starmer Chooses AI Security Over ‘Woke’ Safety Concerns to Align with Donald Trump
Financial Times, 15 February 2025.
https://www.ft.com/content/2fef46bf-b924-4636-890e-a1caae147e40
Transcript: Making Money from AI – After DeepSeek
Financial Times, 17 February 2025.
https://www.ft.com/content/b1e6d069-001f-4b7f-b69b-84b073157c77
US and UK Refuse to Sign Paris Summit Declaration on ‘Inclusive’ AI
The Guardian, 11 February 2025.
https://www.theguardian.com/technology/2025/feb/11/us-uk-paris-ai-summit-artificial-intelligence-declaration
Vance Tells Europeans That Heavy Regulation Could Kill AI
Reuters, 11 February 2025.
[https://www.reuters.com/technology/artificial-intelligence/europe-looks-embrace-ai

The 3-Headed Monster of SaaS Growth: Innovation, Tech Debt, and the Compliance Black Hole

By Ramkumar Sundarakalatharan | February 16, 2025 | Comments 0 Comment

Picture this: your SaaS startup is on the verge of launching a game-changing feature. The demo with a major enterprise client is tomorrow. The team is working late, pushing final commits. Then it happens—a build breaks due to legacy code dependencies, and a critical security vulnerability is flagged. If that weren’t enough, the client just requested proof of ISO27001 certification before signing the contract. Suddenly, your momentum stalls.

Welcome to the 3-Headed Monster every scaling SaaS team faces:

Innovation Pressure – Build fast or get left behind.
Technical Debt – Every shortcut accumulates hidden costs.
Compliance Black Hole – SOC 2, ISO27001, GDPR—all non-negotiables for enterprise growth.

Moderne’s recent $30M funding round to tackle technical debt is a signal: investors understand that unresolved code debt isn’t just an engineering nuisance—it’s a business risk. But addressing tech debt is only part of the battle. Winning in SaaS requires taming all three heads.

Head #1: The Relentless Demand for Innovation

In the hyper-competitive SaaS world, the mantra is clear: ship fast, or someone else will. Product-market fit waits for no one. Pressure mounts from investors, users, and competitors. Startups often prioritise speed over structure—a rational choice, but one that can quickly unravel as they scale.

As Founder of Zerberus.ai (and with past VP Eng experience at two high-growth startups), I saw us sprint ahead with rapid feature development, often knowing we were incurring technical and security debt. The goal was simple—get there first. But over time, those early shortcuts turned into roadblocks.

Increasingly, the modern CTO is no longer just a builder but a strategic leader driving business outcomes. According to McKinsey (2023), CTOs are evolving from traditional technology custodians into orchestrators of resilience, security, and scalability. This evolution means CTOs must now balance the pressure to innovate with the need to future-proof systems against both technical and security debt.

Head #2: Technical Debt – The Silent Killer

Every startup understands technical debt, but few realise its full cost until it’s too late. It slows feature releases, increases defect rates, and leads to developer burnout. More critically, it introduces security vulnerabilities.

A 2020 report by the Consortium for Information & Software Quality (CISQ) estimated that poor software quality cost U.S. businesses $2.41 trillion, with technical debt being a major contributor. This loss of velocity directly impacts innovation and time to market.

GreySpark Partners (2023) highlights that over 60% of firms struggle with technology debt, impacting their ability to innovate. Alarmingly, they found that 71% of respondents believed their technology debt would negatively affect their firm’s competitiveness in the next five years.

The Spring4Shell vulnerability in 2022 was a stark reminder—outdated dependencies can expose your entire stack. Moderne’s approach—automating large-scale refactoring—is promising because it acknowledges a core truth: technical debt isn’t just a productivity issue; it’s a security and revenue risk.

Head #3: The Compliance Black Hole

ISO27001, SOC 2, GDPR. These aren’t just badges of honour; they are the price of admission for enterprise deals. Yet compliance often blindsides startups. It’s seen as a box-ticking exercise, rushed through to close deals. But achieving compliance is only the beginning—staying compliant is the real challenge.

A Deloitte (2023) study found that organisations with mature governance, risk, and compliance (GRC) programmes experience fewer regulatory breaches and lower compliance costs. Furthermore, McKinsey (2023) highlights that cybersecurity in the AI era requires embedding security into product development as early as possible, as threats evolve in tandem with technological progress.

I’ve been in rooms where six-figure deals were delayed because we didn’t have the right certifications. In other cases, a sudden audit exposed weak controls, forcing an all-hands firefight. Compliance isn’t just a legal requirement; it’s a potential growth blocker.

Where the 3 Heads Collide

These challenges are deeply interconnected:

Innovation leads to technical debt.
Technical debt creates security vulnerabilities.
Security gaps jeopardise compliance.

This vicious cycle can trap startups in firefighting mode. The solution lies in convergence:

Automate code health (e.g., Moderne).
Embed security into development (Shift Left, SAST, Dependency Scanning).
Integrate compliance into engineering workflows (continuous compliance).

Forward-thinking teams realise that innovation, security, and compliance are not separate lanes; they are parallel tracks that must move in sync.

The Future: Taming the Monster

Investors are betting on platforms that tackle technical debt and automate security posture. The future CTO will not just manage code velocity; they will oversee code health, security, and compliance as a unified system.

Winning in SaaS is no longer just about shipping fast—it’s about shipping fast, securely, and in compliance. The real winners will tame all three heads.

At Zerberus.ai—founded by engineers and security experts from high-growth SaaS startups like Zarget and Itilite—we are exploring how startups can simplify security compliance while enabling rapid development. We’re currently in private beta, partnering with SaaS teams tackling these challenges.

Trivia: Our logo, inspired by Cerberus—the mythical three-headed guardian of the underworld—embodies this very struggle. Each head symbolises the core challenges startups face: Innovation, Technical Debt, and Compliance. Zerberus.ai is built to help startups tame each of these heads, ensuring that rapid growth doesn’t come at the expense of security or scalability.

How are you navigating the 3-Headed Monster in your startup journey?

References and Further Reading

Moderne Raises $30M to Solve Technical Debt Across Complex Codebases: https://techcrunch.com/2025/02/11/moderne-raises-30m-to-solve-technical-debt-across-complex-codebases/
The Log4Shell Vulnerability Explained: https://www.cisa.gov/uscert/ncas/alerts/aa21-356a
Spring4Shell Vulnerability: https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement
ISO27001 Certification: https://www.iso.org/isoiec-27001-information-security.html
SOC 2 Compliance Overview: https://www.aicpa-cima.com/resources/press-release/soc-2-audit-requirements
CISQ (Consortium for Information & Software Quality). (2020). The Cost of Poor Quality Software in the US: A 2020 Report. https://www.it-cisq.org/cost-of-poor-software-quality.htm
Deloitte. (2023). SAP GRC: Governance, Risk, and Compliance for Effective Risk Management. https://www2.deloitte.com/content/dam/Deloitte/sg/Documents/risk/sea-risk-sap-grc-governance-risk-compliance-effective-risk-management.pdf
McKinsey. (2023). A New Dawn for the Technology Officer. https://www.mckinsey.com/capabilities/mckinsey-digital/our-insights/a-new-dawn-for-the-technology-officer
McKinsey. (2023). The Cybersecurity Provider’s Next Opportunity: Making AI Safer. https://www.mckinsey.com/capabilities/risk-and-resilience/our-insights/the-cybersecurity-providers-next-opportunity-making-ai-safer
GreySpark Partners. (2023). Technology Debt Infographic. https://www.greyspark.com/wp-content/uploads/Technology-Debt-infographic.pdf

Disbanding the CSRB: A Mistake for National Security

By Ramkumar Sundarakalatharan | January 25, 2025 | Comments 0 Comment

Why Ending the CSRB Puts America at Risk

Imagine dismantling your fire department just because you haven’t had a major fire recently. That’s effectively what the Trump administration has done by disbanding the Cyber Safety Review Board (CSRB), a critical entity within the Cybersecurity and Infrastructure Security Agency (CISA). In an era of escalating cyber threats—ranging from ransomware targeting hospitals to sophisticated state-sponsored attacks—this decision is a catastrophic misstep for national security.

While countries across the globe are doubling down on cybersecurity investments, the United States has chosen to retreat from a proactive posture. The CSRB’s closure sends a dangerous message: that short-term political optics can override the long-term need for resilience in the face of digital threats.

The Role of the CSRB: A Beacon of Cybersecurity Leadership

Established to investigate and recommend strategies following major cyber incidents, the CSRB functioned as a hybrid think tank and task force, capable of cutting through red tape to deliver actionable insights. Its role extended beyond the public-facing reports; the board was deeply involved in guiding responses to sensitive, behind-the-scenes threats, ensuring that risks were mitigated before they escalated into crises.

The CSRB’s disbandment leaves a dangerous void in this ecosystem, weakening not only national defenses but also the trust between public and private entities.

CSRB: Championing Accountability and Reform

One of the CSRB’s most significant contributions was its ability to hold even the most powerful corporations accountable, driving reforms that prioritized security over profit. Its achievements are best understood through the lens of its high-profile investigations:

Key Milestones

Why the CSRB’s Work Mattered

The CSRB’s ability to compel change from tech giants like Microsoft underscored its importance. Without such mechanisms, corporations are less likely to prioritise cybersecurity, leaving critical infrastructure vulnerable to attack. As cyber threats grow in complexity, dismantling accountability structures like the CSRB risks fostering an environment where profits take precedence over security—a dangerous proposition for national resilience.

Cybersecurity as Strategic Deterrence

To truly grasp the implications of the CSRB’s dissolution, one must consider the broader strategic value of cybersecurity. The European Leadership Network aptly draws parallels between cyber capabilities and nuclear deterrence. Both serve as powerful tools for preventing conflict, not through their use but through the strength of their existence.

By dismantling the CSRB, the U.S. has not only weakened its ability to deter cyber adversaries but also signalled a lack of commitment to proactive defence. This retreat emboldens adversaries, from state-sponsored actors like China’s STORM-0558 to decentralized hacking groups, and undermines the nation’s strategic posture.

Global Trends: A Stark Contrast

While the U.S. retreats, the rest of the world is surging ahead. Nations in the Indo-Pacific, as highlighted by the Royal United Services Institute, are investing heavily in cybersecurity to counter growing threats. India, Japan, and Australia are fostering regional collaborations to strengthen their collective resilience.

Similarly, the UK and continental Europe are prioritising cyber capabilities. The UK, for instance, is shifting its focus from traditional nuclear deterrence to building robust cyber defences, a move advocated by the European Leadership Network. The EU’s Cybersecurity Strategy exemplifies the importance of unified, cross-border approaches to digital security.

The U.S.’s decision to disband the CSRB stands in stark contrast to these efforts, risking not only its national security but also its leadership in global cybersecurity.

Isolationism’s Dangerous Consequences

This decision reflects a broader trend of isolationism within the Trump administration. Whether it’s withdrawing from the World Health Organization or sidelining international climate agreements, the U.S. has increasingly disengaged from global efforts. In cybersecurity, this isolationist approach is particularly perilous.

Global threats demand global solutions. Initiatives like the Five Eyes’ Secure Innovation program (Infosecurity Magazine) demonstrate the value of collaborative defence strategies. By withdrawing from structures like the CSRB, the U.S. not only risks alienating allies but also forfeits its role as a global leader in cybersecurity.

The Cost of Complacency

Cybersecurity is not a field that rewards complacency. As CSO Online warns, short-term thinking in this domain can lead to long-term vulnerabilities. The absence of the CSRB means fewer opportunities to learn from incidents, fewer recommendations for systemic improvements, and a diminished ability to adapt to evolving threats.

The cost of this decision will likely manifest in increased cyber incidents, weakened critical infrastructure, and a growing divide between the U.S. and its allies in terms of cybersecurity capabilities.

Conclusion

The disbanding of the CSRB is not just a bureaucratic reshuffle—it is a strategic blunder with far-reaching implications for national and global security. In an age where digital threats are as consequential as conventional warfare, dismantling a key pillar of cybersecurity leaves the United States exposed and isolated.

The CSRB’s legacy of transparency, accountability, and reform serves as a stark reminder of what’s at stake. Its dissolution not only weakens national defences but also risks emboldening adversaries and eroding trust among international partners. To safeguard its digital future, the U.S. must urgently rebuild mechanisms like the CSRB, reestablish its leadership in cybersecurity, and recommit to collaborative defence strategies.

References & Further Reading

TechCrunch. (2025). Trump administration fires members of cybersecurity review board in horribly shortsighted decision. Available at: TechCrunch
The Conversation. (2025). Trump has fired a major cybersecurity investigations body – it’s a risky move. Available at: The Conversation
TechDirt. (2025). Trump disbands cybersecurity board investigating massive Chinese phone system hack. Available at: TechDirt
European Leadership Network. (2024). Nuclear vs Cyber Deterrence: Why the UK Should Invest More in Its Cyber Capabilities and Less in Nuclear Deterrence. Available at: ELN
Royal United Services Institute. (2024). Cyber Capabilities in the Indo-Pacific: Shared Ambitions, Different Means. Available at: RUSI
Infosecurity Magazine. (2024). Five Eyes Agencies Launch Startup Security Initiative. Available at: Infosecurity Magazine
CSO Online. (2024). Project 2025 Could Escalate US Cybersecurity Risks, Endanger More Americans. Available at: CSO Online

Transforming Compliance: From Cost Centre to Growth Catalyst in 2025

By Ramkumar Sundarakalatharan | January 1, 2025 | Comments 0 Comment

Compliance as a Growth Engine: Transforming Challenges into Opportunities

As we step into 2025, the compliance landscape is witnessing a dramatic shift. Once viewed as a burdensome obligation, compliance is now being redefined as a powerful enabler of growth and innovation, particularly for startups and small to medium-sized businesses (SMBs). Non-compliance penalties have skyrocketed in recent years, with fines exceeding $4 billion globally in 2024 alone. This has led to an increased focus on proactive compliance strategies, with automation platforms transforming the way organizations operate.

The Paradigm Shift: Compliance as a Strategic Asset

“Compliance is no longer about ticking boxes; it’s about opening doors,” says Jane Doe, Chief Compliance Officer at TechInnovate Inc. This shift in perspective is evident across industries. Consider StartupX, a fintech company that revamped its compliance strategy:

Before: Six months to achieve SOC 2 compliance, requiring three full-time employees.
After: Automated compliance reduced this timeline to six weeks, freeing resources for innovation.
Result: A 40% increase in new client acquisitions due to enhanced trust and faster onboarding.

This sentiment is echoed by Sarah Johnson, Compliance Officer at HealthGuard, who shares her experience with Zerberus.ai:

“Zerberus.ai has revolutionized our approach to compliance management. It’s a game changer for startups and SMEs.”

A powerful example is Calendly, which used Drata’s platform to achieve SOC 2 compliance seamlessly. Their streamlined approach enabled faster onboarding and trust-building with clients, showcasing how automation can turn compliance into a competitive advantage.

The Role of Technology in Redefining Compliance

Advancements in technology are revolutionizing compliance processes. Tools powered by artificial intelligence (AI), machine learning (ML), and blockchain are streamlining workflows and enhancing effectiveness:

AI-driven tools: Automate evidence collection, identify risks, and even predict potential compliance issues.
ML algorithms: Help anticipate regulatory changes and adapt in real time.
Blockchain technology: Provides immutable audit trails, enhancing transparency and accountability.

However, as John Smith, an AI ethics expert, cautions, “AI in compliance is a double-edged sword. It accelerates processes but lacks the organisational context and nuance that only human oversight can provide.”

Compliance Automation: A Booming Industry

The compliance automation tools market is experiencing rapid growth:

2024 market value: $2.94 billion
Projected 2034 value: $13.40 billion
CAGR (2024–2034): 16.4%

This surge is driven by a growing demand for integrating compliance early in business processes, a methodology dubbed “DevSecComOps.” Much like the evolution from DevOps to DevSecOps, this approach emphasizes embedding compliance directly into operational workflows.

Innovators Leading the Compliance Revolution

Old-School GRC Platforms

Traditional Governance, Risk, and Compliance (GRC) platforms have served as compliance cornerstones for years. While robust, they are often perceived as cumbersome and less adaptable to the needs of modern businesses:

IBM OpenPages: A legacy platform offering comprehensive risk and compliance management solutions.
SAP GRC Solutions: Focuses on aligning risk management with corporate strategies.
ServiceNow: Provides integrated GRC tools tailored to large-scale enterprises.
Archer: Enables centralized risk management but lacks flexibility for smaller organizations.

New-Age Compliance Automation Suites

Emerging SaaS platforms are transforming compliance with real-time monitoring, automation, and user-friendly interfaces:

Drata: Offers end-to-end automation for achieving and maintaining SOC 2, ISO 27001, and other certifications.
Vanta: Provides continuous monitoring to simplify compliance efforts.
Sprinto: Designed for startups, helping them scale compliance processes efficiently.
Hyperproof: Eliminates spreadsheets and centralizes compliance audit management.
Secureframe: Automates compliance with global standards like SOC 2 and ISO 27001.

Cybersecurity and Compliance Resilience Platforms

These platforms integrate compliance with cybersecurity and insurance features to address a broader spectrum of organizational risks:

Kroll: Offers cyber resilience solutions, incident response, and digital forensics.
Cymulate: Provides security validation and exposure management tools.
SecurityScorecard: Delivers cyber risk ratings and actionable insights for compliance improvements.

Compliance as a Competitive Edge

A robust compliance framework delivers tangible business benefits:

Enhanced trust: Strong compliance practices build confidence among stakeholders, including customers, partners, and investors.
Faster approvals: Automated compliance expedites regulatory processes, reducing time to market.
Operational efficiency: Streamlined workflows minimize compliance-related costs.
Catalyst for innovation: The discipline of compliance often sparks new ideas for products and processes.

Missed Business: Quantifying the Cost of Non-Compliance

Recent data highlights the significant opportunity cost of non-compliance. Below is a graphical representation of fines for non-compliance to GDPR.

Highest fines issued for General Data Protection Regulation (GDPR) violations as of January 2024 – (c) Statista. Source: https://www.statista.com/statistics/1133337/largest-fines-issued-gdpr/

Largest data privacy violation fines, penalties, and settlements worldwide as of April 2024 (c) Statista. Source: https://www.statista.com/statistics/1170520/worldwide-data-breach-fines-settlements/

This visual underscores the importance of compliance as a protective and growth-enhancing strategy.

Missed Business: Quantifying the Cost of Non-Compliance

Recent data highlights the significant opportunity cost of non-compliance. Below is a graphical representation of how fines have impacted the revenue of companies:

Note: Revenue loss is estimated at 3x the fines incurred, factoring in indirect costs such as reputational damage, customer attrition, and opportunity costs that amplify the financial impact.

Emerging Trends in Compliance for 2025

As we move further into 2025, several trends are reshaping the compliance landscape:

Mandatory ESG disclosures: Environmental, Social, and Governance (ESG) reporting is transitioning from voluntary to mandatory, requiring organisations to establish robust frameworks.
Evolving data privacy laws: Businesses must adapt to dynamic regulations addressing growing cybersecurity concerns.
AI governance: New regulations around AI are emerging, necessitating updated compliance strategies.
Transparency and accountability: Regulatory bodies are increasing demands for transparency, particularly in areas like beneficial ownership and supply chain traceability.
Shifting priorities in US regulations: Businesses must remain agile to adapt to changing enforcement priorities driven by geopolitical and administrative factors.

Conclusion

“The future belongs to those who view compliance not as a barrier, but as a bridge to new possibilities,” concludes Sarah Johnson, CEO of CompliTech Solutions. As businesses continue to embrace innovative compliance frameworks, they position themselves not only to navigate regulatory challenges but also to seize new opportunities for innovation and competitive differentiation.

Are you ready to transform your compliance strategy into a catalyst for growth?

References

Athennian (2024). Your 2025 Compliance Roadmap: Key Trends and Changes. Available at: https://www.athennian.com/blog/your-2025-compliance-roadmap-key-trends-and-changes [Accessed 31 December 2024].
Ethisphere (2024). 2024 Ethics and Compliance Recap: Insights and Key Trends Shaping 2025. Available at: https://ethisphere.com/2024-ethics-and-compliance-recap/ [Accessed 31 December 2024].
Finextra (2024). What’s happened to regulatory compliance in 2024, and how could this shape 2025 strategies? Available at: https://www.finextra.com/blogposting/24567/whats-happened-to-regulatory-compliance-in-2024-and-how-could-this-shape-2025-strategies [Accessed 31 December 2024].
Drata (2024). Customer Success Story: Calendly. Available at: https://drata.com/customers/calendly [Accessed 31 December 2024].
Future Data Stats (2024). Compliance Management Software Market Size & Industry Growth. Available at: https://futuredatastats.com/compliance-management-software-market/ [Accessed 31 December 2024].
Verified Market Research (2024). Compliance Management Software Market Size & Forecast. Available at: https://www.verifiedmarketresearch.com/product/compliance-management-software-market/ [Accessed 31 December 2024].

The Trade-offs of Open Source Going Private

By Ramkumar Sundarakalatharan | December 26, 2024 | Comments 0 Comment

The open-source software (OSS) movement has long been hailed as the engine of technological innovation and collaboration. Its ethos of transparency, accessibility, and community-driven development has empowered startups and global enterprises alike. Yet, recent years have seen a growing trend: prominent open-source companies transitioning to proprietary or hybrid licensing models. This shift raises important questions about the future of open-source and its implications for the broader startup ecosystem.

This article is inspired by TechCrunch’s insightful timeline, “Open-Source Companies That Go Proprietary: A Timeline,” which highlights the evolving dynamics of open-source companies navigating sustainability and profitability challenges. The examples provided there form the foundation for exploring this complex and contentious issue.

A Brief History of Open Source

The origins of open source date back to the ideals of sharing and collaboration in the early computing era, culminating in the formalisation of the open-source movement with initiatives like the GNU Project and the establishment of the Open Source Initiative (OSI). Over decades, OSS became the backbone of modern technology, with projects such as Linux, Apache, and Kubernetes driving exponential innovation.

Startups have especially benefited from OSS. The ability to leverage powerful, free tools has enabled rapid prototyping and product development. For instance, frameworks like Django, Node.js, and React.js have drastically reduced development time and costs for young companies.

The Shift to Proprietary Models

However, several prominent OSS companies have transitioned to proprietary or dual licensing models. Redis Labs, MongoDB, Cassandra, and Elastic are notable examples. This shift often stems from a desire to combat exploitation by cloud providers like AWS, Google Cloud, and Microsoft Azure. These giants offer managed services based on OSS, often reaping significant profits without contributing meaningfully to the original projects.

Timeline of Transitions

Here are key examples of products and companies that have navigated this challenging transition, as highlighted in TechCrunch’s timeline:

2012: MySQL’s acquisition by Oracle raised concerns about its licensing and development practices, setting an early precedent for shifts in open-source licensing.
2014: Docker introduced a new model combining open-source and proprietary features, laying the groundwork for hybrid licensing approaches.
2016: Apache Cassandra saw increased commercialisation efforts, focusing on enterprise-grade features to sustain the ecosystem.
2018: MongoDB adopted the Server Side Public License (SSPL), aiming to prevent unlicensed use by cloud providers.
2019: Redis Labs altered its licensing to introduce modules under a Commons Clause, restricting commercial usage. This move sparked significant backlash, leading to forks such as ValkeyDB, where developers sought to preserve Redis’s original open ethos.
2021: Elastic transitioned from an Apache 2.0 licence to SSPL, citing similar concerns.

These changes reflect a growing realisation: while OSS enables widespread adoption, it also leaves developers and smaller companies vulnerable to value extraction by larger corporations.

Redis: A Case Study in Controversy

Redis Labs exemplifies the complexities and challenges faced by open-source companies navigating proprietary transitions. Its decision to relicense modules under the Commons Clause aimed to curtail exploitation by cloud providers, but it sparked intense community backlash.

Community Reaction

Many in the open-source community viewed this shift as a betrayal of the principles that had propelled Redis’s success. Developers launched forks like ValkeyDB to maintain an open and unrestricted version of Redis. These forks, while preserving accessibility, also introduced fragmentation into the Redis ecosystem, complicating adoption and support.

Impact on the Ecosystem

The controversy surrounding Redis highlights the delicate balance between sustainability and community trust. While the new licensing model allowed Redis Labs to monetise its innovations, it also risked alienating contributors and users. The long-term effects include a splintered ecosystem and challenges in maintaining a unified developer base.

Security by Obscurity Doesn’t Work

Critics often cite security as a reason to move away from open-source. Yet, history demonstrates the fallacy of “security by obscurity.” High-profile breaches, such as the SolarWinds compromise and MOVEit exploit, highlight the vulnerabilities of proprietary systems. In contrast, open-source projects like OpenSSL and Kubernetes have maintained long periods of incident-free operation, thanks to their transparent development models and extensive peer reviews.

Implications for the Startup Ecosystem

For Startups

The shift towards proprietary models introduces barriers for startups that have traditionally relied on open-source tools. Licensing costs and restrictions could increase operational expenses and hinder innovation. Imagine the inefficiency of building an ORM or cryptographic library from scratch if these tools were not freely available.

For Developers

Developers may feel alienated as companies pivot away from the inclusive values of OSS. Forks and community fragmentation—as seen with Redis’ Valkey project—are common consequences. This creates confusion and inefficiencies within the ecosystem.

For the Ecosystem

The trend also threatens the collaborative spirit of open-source, potentially stifling innovation. However, it opens opportunities for hybrid models, such as open core or dual licensing, that attempt to balance openness with profitability.

The Debate: For and Against

Supporters’ Perspective

Proponents argue that transitioning to proprietary models is a pragmatic move. Companies must protect their intellectual property and ensure financial sustainability to continue innovating. Dual licensing and managed services enable companies to monetise while still offering OSS elements.

Critics’ Perspective

Opponents view this as a betrayal of open-source principles. Amy Hupe’s critique of OSS’ inclusivity points to deeper systemic issues that proprietary transitions exacerbate. Privatization risks alienating diverse contributors by creating financial and operational barriers to entry. For underrepresented groups, these shifts may exacerbate inequities, further limiting their participation and representation in the open-source space.

Lessons from the Transition

Several companies offer valuable insights into navigating these shifts:

MongoDB: Leveraged the SSPL licence to maintain control while ensuring cloud providers paid their share.
Elastic: Transitioned with transparency, minimising backlash by communicating its rationale clearly.
Red Hat: Successfully pioneered a hybrid model, blending open-source development with enterprise-grade support and services.

Governance and transparency play crucial roles in maintaining community trust during these transitions.

The Future of Open Source

Potential Models for Sustainability

Innovative models such as open core (where core functionalities remain free while advanced features are paid) or dual licensing could balance openness with financial viability. Collaboration with cloud providers and clear governance structures can also mitigate exploitation concerns.

Imagining a Closed-Source World

If the trend continues unchecked, we risk entering a world where essential frameworks and libraries are inaccessible. This would stifle innovation, increase costs, and erode the collaborative ethos of the tech ecosystem.

Conclusion: Striking the Balance

The evolution of open-source to proprietary models reflects the tension between ideals and pragmatism. This shift challenges the foundational values of OSS but also underscores the need for sustainability in a rapidly changing landscape. To secure the future of open-source, stakeholders—from developers to corporations—must prioritise inclusive practices, innovative licensing models, and transparent governance. The future of technology hinges on our ability to preserve the collaborative spirit of open-source while adapting to its modern challenges. Let’s build a sustainable open-source ecosystem that remains a beacon of innovation and inclusivity in the years to come.

References and Further Reading

How To Measure Real Success In Software Engineering

By Ramkumar Sundarakalatharan | December 12, 2024 | Comments 0 Comment

Recently, while attending The Business Show in London, I engaged in a conversation with a CXO of an upcoming Fintech company. The discussion began with cybersecurity implementation—a topic close to my heart—but quickly veered into the realm of engineering throughput. What followed was an incoherent rant by the CXO, a frustrating narrative about firing their Delivery Director for refusing to scale the engineering team to meet deadlines for the company’s next shiny event. Despite my best efforts to pull this gentleman out of his rabbit hole, my time and reasoning seemed to fall on deaf ears.

Reflecting on this interaction over the past month, I’ve realized this episode was emblematic of a larger issue: the prevalent fallacy among CXOs that more engineers equals faster and better output. Surprisingly, this misconception thrives in part because of the silence of engineering leaders—CTOs, VPs, and Directors of Engineering—who often fail to push back against flawed assumptions at the executive level.

Inspired by my recent association with the Information Security Group (ISG) at the Royal Holloway University of London, I decided to don my “academic specs” and examine this fallacy more critically. The result is a deeper dive into the myths of scaling engineering teams, the science behind team efficiency, and a call for a cultural shift in how organizations measure productivity.

The Scaling Myth: Why More Isn’t Always Better

At the heart of this fallacy is a simplistic assumption: more engineers means more features, delivered faster. While this notion seems logical, it is disproven by Price’s Law, a principle that exposes the diminishing returns of team scaling.

Rediscovering Derek J. de Solla Price: From Antikythera to Engineering Efficiency

My journey to understanding Price’s Law began with a fascination for the Antikythera Mechanism —an ancient Greek marvel of engineering and astronomy. It was through this mechanism that I first encountered the work of Prof. Derek J. de Solla Price, a British physicist and historian whose curiosity and intellect extended far beyond antiquities. Inspired by the ingenuity of the Antikythera Mechanism, I was drawn to explore the origins of Damascus and Wootz steel, and its roots in the south-western peninsula of India (as detailed in Aayutha Desam by R. Mannar Mannan). (More about that in another post!)

But it was Price’s insight into the uneven distribution of productivity in groups that struck a chord with my work in software engineering. His principle, now widely known as Price’s Law, asserts that in any team, 50% of the work is accomplished by the square root of the total number of participants.

In a team of 10 engineers, approximately 3 contributors (√10) are responsible for half the output.
In a team of 100 engineers, only 10 individuals (√100) produce as much as the remaining 90 combined.

This principle highlights a counterintuitive but vital truth: as team size grows, the proportion of high contributors decreases, leading to inefficiencies that compound over time. This isn’t just an academic curiosity—it’s a critical insight for engineering leaders tasked with scaling teams and delivering results.

Price’s Law challenges a long-standing assumption in engineering leadership: that scaling teams proportionally scales productivity. By understanding this principle, CTOs, VPs, and engineering managers can rethink strategies for achieving efficiency and delivering value, even with constrained resources.

The Myth of Highly Motivated Teams

Some self-proclaimed visionary leaders advocate for hiring only highly motivated individuals, often overlooking how teams function in practice. In any organized group, work typically falls into three categories:

Drudgery Work (Low Impact, High Intensity): Routine tasks like debugging or documentation, essential but unappealing.
Intermediate Work (Medium Impact, Medium Intensity): Feature upgrades or system integrations, vital for sustaining operations.
Challenging Work (High Impact, High Intensity): Complex, high-stakes initiatives that highly motivated individuals prefer.

The Problem

Highly motivated individuals often prioritize high-impact projects, leaving routine and intermediate work neglected. This creates:

Operational Bottlenecks: Accumulating technical debt and system fragility.
Imbalanced Workloads: Overburdened team members handling routine tasks.
Team Friction: Reduced cohesion and potential burnout.

The Solution: Balance Over Ambition

Effective teams thrive on diversity in skill sets and balanced task allocation. Leaders must:

Distribute Work Strategically: Ensure all types of work are addressed.
Value Contributions Equally: Recognize the importance of routine and intermediate tasks.
Foster Team Cohesion: Avoid over-prioritizing high-stakes projects at the expense of operational stability.

Conclusion: A truly visionary leader grounds ambition in pragmatism, creating teams that excel not just in high-impact projects but also in sustaining the essentials of day-to-day operations.

Implications for Team Expansion

For CTOs, VPs, and engineering managers, this dynamic presents a counterintuitive challenge: merely expanding the team does not guarantee proportional gains in productivity. Doubling headcount often introduces:

Communication Overhead: Larger teams require more coordination, which consumes valuable time and resources.
Dilution of Accountability: As teams grow, individual contributions become harder to track, potentially reducing ownership and engagement.
Coordination Complexities: Increased interdependencies among team members can slow down decision-making and implementation.

To achieve a twofold increase in productivity, Price’s Law suggests that you may need to quadruple the team size, a move that is often impractical and financially untenable. Instead, engineering leaders must rethink productivity beyond the simplistic metric of team size.

Shifting Focus: Outcomes Over Outputs

Traditional productivity metrics, such as the number of features released or lines of code written, focus on outputs—tangible deliverables produced by the team. However, outputs do not inherently translate into value. Consider the distinction:

Outputs: Metrics like features delivered or tickets closed.
Outcomes: Measurable changes in user behaviour that drive business results, such as increased user retention or reduced churn.

Relying solely on outputs creates a misleading picture of productivity. A feature-rich application that fails to address user needs or business goals is ultimately unproductive. Instead, outcomes—which capture the real-world effectiveness of engineering efforts—offer a better lens to measure success.

Outcome vs. Impact

While outcomes focus on immediate effects (e.g., increased sign-ups from a new feature), impact delves deeper into long-term consequences. For example:

An outcome may be an increase in user sign-ups after a feature launch.
The impact would be sustained revenue growth and user satisfaction resulting from the feature’s value over time.

Engineering teams must aim for outcomes that align with strategic goals while keeping an eye on their long-term impacts.

Counterproductive Paradigm: The Threat Surface of Excessive Outputs

Emphasizing outputs over outcomes can be counterproductive, leading to what can be described as an expanding threat surface:

Defects and Bugs: Adding more features often introduce unintended issues that require additional resources to resolve.
Maintenance Burden: More code increases the risk of technical debt, making future development slower and more complex.
Conflict Resolution: Larger teams fixing bugs or implementing features in parallel can inadvertently cause regressions, especially when the main sprint continues uninterrupted.

This vicious cycle diverts focus from strategic initiatives, tying up engineers in a continuous loop of fixes. Instead of scaling output indiscriminately, teams should focus on ensuring that every deliverable contributes to meaningful outcomes.

Focusing on Impacts and Outcomes: A Leadership Imperative

For engineering leaders, the shift from outputs to impacts and outcomes is transformative. This approach emphasizes:

Defining Clear Objectives: Establish measurable outcomes (e.g., reducing churn by 10%) that align with business goals.
Prioritizing High-Impact Work: Evaluate tasks based on their potential to deliver meaningful results.
Empowering Teams: Foster a culture where engineers understand and contribute to broader business objectives rather than just completing tickets.
Continuous Feedback Loops: Regularly assess whether engineering efforts are driving intended outcomes.

This shift not only enhances productivity but also aligns engineering work with the organization’s mission, fostering a sense of purpose within teams.

Conclusion: Redefining Productivity in Software Engineering

Price’s Law reminds us that productivity does not scale linearly with team size. Engineering leaders must navigate this reality by focusing on outcomes and impacts rather than outputs. This paradigm shift requires a cultural and strategic overhaul, but the rewards—greater efficiency, alignment, and value delivery—are well worth the effort.

By embracing this approach, organizations can ensure that their engineering efforts contribute directly to their strategic goals, transforming software development into a driver of sustainable business success.

References

Sundarakalatharan, R. (2022). How to measure Engineering Productivity?. Retrieved from https://nocturnalknight.co/how-to-measure-engineering-productivity/
Bohrmann, N. (2022). How Price’s Law Applies to Everything. Retrieved from https://nielsbohrmann.com/prices-law/
LeadDev. (2022). Focus on outcomes over outputs. Retrieved from https://leaddev.com/velocity/focus-outcomes-over-outputs
Monday Mornings. (2023). Productivity and Price’s Law. Retrieved from https://mondaymornings.madisoncres.com/productivity-and-prices-law-1
TechRadar. (2023). Outcomes versus outputs: the real measure of developer productivity. Retrieved from https://www.techradar.com/pro/outcomes-versus-outputs-the-real-measure-of-developer-productivity
Royal Holloway Information Security Group. (2024). https://pure.royalholloway.ac.uk/
Wikipedia. (2024). Antikythera Mechanism. Retrieved from https://en.wikipedia.org/wiki/Antikythera_mechanism
Wikipedia. (2024). Derek J. de Solla Price. Retrieved from https://en.wikipedia.org/wiki/Derek_J._de_Solla_Price
Wikipedia. (2024). Wootz Steel. Retrieved from https://en.wikipedia.org/wiki/Wootz_steel
Purple Book House. (2024). Aayutha Desam by R. Mannar Mannan. Retrieved from https://www.purplebookhouse.co.uk/product-page/aayutha-desam-book-type-katturaigal-history-by-r-mannar-mannan