Business continuity strategies: why backups alone are not enough

Business continuity strategies: why backups alone are not enough
For business


Kate MenziesPublished on March 11, 2026

Most teams start their business continuity strategies with the same assumption: If we have backups, we can recover. Backups are important, but they’re only one piece of continuity, and often not the element that fails first.

In modern, cloud-heavy environments, the fastest path to downtime is often loss of access: stolen credentials, locked-out administrators, misconfigured identity settings, or an incident that forces you to revoke access faster than you can restore systems. If your team can’t sign in, approve changes, rotate secrets, or coordinate response securely, having clean backups won’t get operations back online.

This article explains what business continuity strategies are (and how they connect to disaster recovery planning), why backups alone create blind spots, and which security-focused controls strengthen a business continuity plan in practice—especially around access and credential security.

It also shows where a business password manager like Proton Pass for Business fits into business networks: helping teams reduce credential risk and keep access controls usable, auditable, and resilient.

What are business continuity strategies?

Why backups alone are not enough

What is the role of access and credential security in continuity planning?

Which measures strengthen business continuity beyond backups?

How does Proton Pass for Business support continuity strategies?
What are business continuity strategies?

Business continuity is the set of plans, processes, and procedures an organization uses to keep essential functions running during and after disruptions. It typically includes risk assessment, emergency response procedures, communication plans, backup and recovery, staff training, as well as a regular schedule for testing and updating that plan.

A business continuity plan is where these strategies become operational: who does what, in what order, with which tools, and what “acceptable service” looks like under pressure.
Business continuity vs. disaster recovery planning

Business continuity strategies often get conflated with disaster recovery planning, and both are sometimes confused with incident response. They work together, but they solve different problems.Incident response focuses on the security event itself: detecting what’s happening, containing the threat, removing it from affected systems, and investigating impact so you can prevent recurrence.
Disaster recovery focuses on restoring IT systems and data after disruption — for example, infrastructure failure, corrupted databases, or a cloud region outage.
Business continuity planning focuses on keeping essential operations running during disruption, even when technology is degraded. It covers people, processes, vendors, communications, and decision-making — and defines how the business continues to deliver critical services while recovery is underway.

This distinction is important. The FFIEC’s Business Continuity Management booklet(new window) (written for financial institutions but broadly applicable) emphasizes that business continuity planning is about maintaining, resuming, and recovering the business, not only the technology.
Why having a continuity strategy matters

A continuity plan that lives in a folder and hasn’t been tested isn’t a strategy; it’s just a document. An actual strategy is something you can run:You know which functions are truly critical.
You’ve defined what “downtime” means in measurable terms.
You’ve rehearsed scenarios that stress the whole organization, not just the IT team.
You can prove controls work and improve them over time.

That’s why business continuity overlaps with governance and compliance. Many frameworks (such as ISO 22301 for business continuity management, sector rules, customer questionnaires) want evidence that continuity is repeatable, owned, and tested, not improvised.
Why backups alone are not enough

Backups solve a specific problem: data restoration. However, incidents rarely arrive as a neat “data lost” event. In the real world, disruptions create multiple constraints at once, and backups don’t address several of the most common failure modes.
Backups don’t help if you can’t access the systems that restore them

A continuity plan often assumes your administrators can sign in, elevate privileges, and execute recovery workflows. But many incidents begin with credential compromise, identity provider lockouts, or account takeover. If attackers get in first, they may change passwords, rotate keys, add new admin accounts, or disrupt your identity stack. Recovery then becomes a race for control, not a restore-from-backup task.

This is one reason incident response planning belongs next to business continuity planning, not as a separate security document. Proton’s incident response guide stresses that incident response starts with understanding threats and defining actions you’ll take when affected, which directly impacts how quickly you recover access.
Backups don’t prevent downtime caused by everything else

Backups won’t stop the kinds of disruptions that shut teams down before any data restore even begins, for example:A widespread SaaS outage that blocks access to core tools.
A credential phishing campaign that forces mass password resets and account lockdowns.
A malicious configuration change that breaks permissions or sharing.
Ransomware that disrupts endpoints and authentication.
A vendor incident that requires urgent access revocation and customer communication.

In all of these scenarios, the immediate continuity question is the same: Can we keep operating safely while we fix this? Backups may help later, but they don’t solve the first-hour problem.
Backups don’t reduce legal and compliance exposure from data access

Backups restore data; they don’t undo unauthorized access. If sensitive information was accessed or exfiltrated, you may still face contractual obligations, regulatory reporting, or customer trust impacts, even if you restore systems perfectly.

This is where continuity strategies should include preventive controls and detection — and needs tight alignment with security and incident response — because recoverable is not the same as acceptable.
Backups can fail, and attackers know it

Backup failure isn’t always technical. Common issues include:Incomplete coverage (critical SaaS data wasn’t backed up)
Stale backups (recovery point objective is worse than assumed)
Untested restores (the backup exists but cannot be restored quickly)
Unavailability of required credentials and keys in an incident.

According to the FFIEC booklet, the effectiveness of a business continuity plan can only be validated through testing or practical application. If you haven’t tested restoring workflows under realistic constraints (limited staff, stressed systems, uncertain scope, access restrictions), you don’t know your real recovery time.
Backups don’t address the human continuity problem

Continuity is also about coordination: who approves emergency actions, how you communicate internally, how you avoid unsafe workarounds, and how you maintain accountability. If your only plan is to restore from backup, you’re underestimating the operational complexity of incidents.

This is why business continuity strategies are increasingly security-focused: the same weaknesses that cause breaches (weak access control, inconsistent credential hygiene, unclear ownership) also provoke extended downtime.
What is the role of access and credential security in continuity planning?

If backups are the recovery layer, access and credential security are the control layer, the part that determines whether you can act quickly and safely during disruption.

In practical continuity terms, credentials matter because they control:Who can execute recovery actions (restore, rotate, revoke, isolate).
How fast you can contain the incident (disable accounts, cut access, reset keys).
How confident you are in your environment (audit trails, verified changes, least privilege).
Whether people can keep working securely (without copying secrets into chats or personal notes).

This is why the best business continuity strategies treat credential governance as a continuity requirement, not just an IT hygiene item.

A technology risk management program can help you formalize this. Proton’s technology risk management plan article explicitly frames risk management as a way to prevent major incidents, which includes creating incident response plans and reducing the spread of sensitive data by using secure password managers and secure storage.
Which measures strengthen business continuity beyond backups?

Below, you’ll find seven security-focused measures that strengthen continuity in modern environments. You don’t need to implement them all at once. The goal is to reduce your most likely downtime drivers and to make recovery actions feasible under stress.
1. Define continuity requirements around critical workflows

Start with the question: What needs to keep working for us to deliver essential services? Then map the supporting tools, people, and dependencies.

A good business impact analysis and an accurate risk assessment are widely recognized as foundational to an effective business continuity plan. This is where you define what unacceptable downtime looks like to your business, which functions are time-critical, and where the biggest dependency risks live.

From a security angle, continuity planning should extend beyond core infrastructure. You must consider:Identity providers and admin consoles.
Password and key storage.
Shared inboxes and customer communication channels.
Finance tools and payment workflows.
Vendor access paths and integrations.

If a disruption blocks access to any of these systems, teams may be unable to operate or execute recovery steps. At that moment, downtime is an access problem, not a data-loss problem.
2. Treat access control as a continuity control

Access control is often discussed as security, but it’s also continuity engineering. During an incident, you need to reduce risk quickly without breaking the business.

Practical continuity-minded access patterns include:Least-privilege roles for day-to-day work.
Separate admin accounts (used only when needed).
Clear break glass procedures for emergency access.
Documented ownership for critical systems and vaults.
Scheduled access reviews and offboarding controls.

The point isn’t to add bureaucracy; it’s to ensure you can change access rapidly and confidently when the environment is unstable.
3. Centralize credential governance

Shadow access happens when credentials are stored outside controlled systems: browser-saved passwords, shared spreadsheets, notes, ticket comments, or temporary chat messages. These shortcuts feel productive until you’re trying to contain an incident and discover you don’t know who has access to what. A key finding of our 2026 SMB cybersecurity report was that teams with password managers often didn’t use them.

Centralized credential governance means:Credentials live in a controlled system.
Sharing is deliberate and revocable.
Offboarding isn’t a scavenger hunt.
Rotations can happen without breaking workflows.
You can prove your controls exist.

This is a continuity win as much as a security win: the fewer unknown credentials that exist, the fewer emergency resets you need.
4. Elaborate a credential compromise playbook

Credential compromise often triggers the most disruptive continuity actions: e.g., mass resets, revoked sessions, forced multi-factor authentication (MFA) changes, access reviews, and emergency communications. If you’ve never rehearsed it, the situation becomes chaotic quickly.

A credential compromise playbook should answer:How do we detect signs of compromise?
Who can revoke access and where?
What do we rotate first (high-privilege accounts, shared vaults, API keys)?
How do we communicate changes without leaking secrets?
How do we keep customer-facing operations running during resets?

This is where incident response and continuity overlap directly. Incident response planning is not an extra. It’s how you stop relying on improvisation and start relying on continuity.
5. Use encryption to reduce impact, not just for compliance

Encryption is typically framed as a compliance checkbox. In continuity terms, encryption reduces blast radius when things go wrong.

Examples:Encrypted credential vaults protected by access keys reduce the risk of secrets being exposed through device compromise or insecure storage.
End-to-end encryption models limit visibility of sensitive content, which can matter for risk posture and data protection.
Strong encryption also supports safer collaboration (sharing access without exposing secrets in plain text).

This is also where many teams get stuck: they want encryption, but they worry it will slow down work. The right tools make encryption part of normal workflows, not a special process people use to bypass.
6. Make security awareness operational

In many organizations, the first continuity break is a human workaround: someone shares a password over chat because a teammate is locked out; someone uses a personal account to keep work moving; someone approves an urgent access request without checking scope.

This is why security awareness is a continuity control. It reduces the chance that a disruption becomes worse through reactive behavior.

If you need a practical baseline for small teams that still applies to enterprise habits, Proton’s roundup of cybersecurity solutions for small businesses emphasizes choosing tools that reduce risk without requiring heavy time or budget investment.

The aim is simple: make secure actions the easiest actions, especially when people are stressed.
7. Test your plan like you expect it to fail, and improve continuously

A continuity plan that hasn’t been tested is still an assumption. Testing shows what actually works under pressure: whether recovery steps are executable, access rights are correct, credentials can be retrieved securely when required, communication paths hold up, vendor dependencies are clear, and your critical functions were prioritized correctly.

The FFIEC booklet explicitly affirms that business continuity planning is only proven through testing or real-world use, so tabletop exercises should reflect modern scenarios, such as:Authentication outage tied to a SaaS provider.
A credential compromise that forces rapid rotations
Ransomware that requires isolation and emergency access changes.
A vendor incident that demands fast containment and coordinated communications.

Therefore, treat what you’ve learned like product work: capture the gaps, assign owners, set deadlines, and retest until the plan is reliable.
How does Proton Pass for Business support continuity strategies?

Proton Pass for Business is not a full business continuity platform, and it doesn’t replace backup systems, DR infrastructure, or broader governance. Where it supports business continuity strategies most directly is in a high-leverage continuity control area: credentials and access.

Continuity efforts often fail in the messy middle of incidents: when teams are trying to contain risk, keep operations running, and coordinate changes without leaking secrets or losing control. Proton Pass for Business helps reduce that chaos by making secure credential practices easier to adopt and enforce.

Here’s how it maps to continuity needs:Secure, centralized credential storage and sharing. Proton Pass is designed for business credential management, helping teams avoid storing secrets in scattered documents or chats, therefore enabling safer sharing patterns.
Administrative controls and governance. Proton Pass for Business includes team management and security policies (including rules around sharing and 2FA), which support continuity governance as organizations scale.
Visibility through logs and reporting. During disruption, visibility matters. You need to know what changed and when. Proton Pass offers usage logs and reporting, so admins can review activity across team accounts.
Trust through transparency. Proton’s approach emphasizes verifiable security: Proton Pass is open source, and Proton publishes independent audits, supporting organizations that seek evidence-based security controls.
Dark web monitoring. Pass Monitor alerts admins and team members if logins stored in their Proton Pass vaults appear in breach datasets, so they can rotate affected credentials early and reduce post-compromise risk.
Password health check. Pass Monitor also flags weak or reused passwords (and inactive 2FA), helping teams fix risky credentials before they’re exploited.

In continuity terms, the value is practical: fewer unknown credentials, less insecure workarounds during incidents, faster rotations when compromise is suspected, and clearer accountability for access changes. That’s how access and password management stop being just security and become operational resilience.
Final takeaway: continuity is a system, not a backup job

Backups are necessary, but modern business continuity strategies require more than recovery storage. They ask for a plan you can run under pressure, controls you can prove, and access practices that won’t collapse when the environment becomes unstable.

If you want a practical roadmap to strengthen continuity through security, with quick wins you can implement now, download Proton’s comprehensive security ebook for growing businesses.

Proton Mail: https://go.getproton.me/aff_c?offer_id=7&aff_id=13658

Alberta Municipality Bets Tens of Millions on Wonder Valley Data Centre

Alberta Municipality Bets Tens of Millions on Wonder Valley Data Centre

Alberta Municipality Bets Tens of Millions on Wonder Valley Data Centre
March 9, 2026
Reading time: 4 minutes

Full Story: The Energy Mix
Jody MacPherson








Photo of Kyle Reiling speaking at the PTAC conference. Provided by PTAC.



This story is part of our ongoing investigative series, Hidden Wonder Valley.

A rural Alberta municipality has spent about C$70 million to lay the groundwork for ‘Wonder Valley,’ the proposed site for the world’s largest artificial intelligence data centre powered by North America’s largest gas-fired plant.

And while the municipality lacks a formal purchase agreement more than a year after the project was first announced, a local official says he’s confident it will move forward.

The process has not been easy, Kyle Reiling, executive director of the Greenview Industrial Gateway (GIG), where Wonder Valley is being floated, told a gathering of the Petroleum Technology Alliance Canada (PTAC) in Calgary last week.

First announced by Kevin O’Leary in December, 2024, the vision for Wonder Valley is massive: the celebrity investor promised to raise $70 billion to build a 7.5-gigawatt gas-powered data centre on 14,000 acres in Greenview, about 460 kilometres northwest of Edmonton.

At one point, when Reiling was balking at the plans for millions in spending, he said council told him to keep going: “‘we believe in this, we believe that this is the right thing to do, and we’re going to signal to the province and we’re going to signal to industry that we’re moving ahead with this.’”

Reiling said he modelled the industrial area after the Heartland Designated Industrial Zone northeast of Edmonton.


Get the latest climate news and analysis, direct to your inbox.


View our latest digests

Heartland is a formalized agreement to streamline regulations and cluster petrochemical infrastructure in one area. Five municipalities, some environmental groups, and more than 40 companies participate, with help and incentives from the provincial government.

Greenview is not a designated industrial zone but was originally the site intended for a petrochemical plant. The initial plan was to process gas into commodities like ammonia, methanol, and ethanol, but Reiling said the community “couldn’t get the carbon hub created in time.”

It was a “real letdown for the region” when the project did not go ahead, he said.

He added that the municipality has invested millions over the last decade on roads, water outtake from the nearby Smoky River, laser imaging, and geochemical and biophysical work on the industrial land.

Reiling, who is an employee of the municipality, is also actively involved in planning the Wonder Valley project.

“Our conference calls start very early because we have members in the United Arab Emirates, but we also have members in Indianapolis, New York, Florida, Louisiana, and Grand Prairie,” he told the PTAC audience. “And we get together with one common goal, and that’s to design Wonder Valley.”

Last month, O’Leary’s company announced a second Wonder Valley project in northern Utah that would be the same size as its Alberta twin. “The reality is that we’re competing against Utah, where they have given them a 12-week approval process on 13,000 acres,” Reiling said.

The Alberta government has offered support to companies, including access to a provincial concierge service to help AI data centre proponents navigate the regulatory process.

“We will work with you and bring the right people to the table at the right time and make sure that they have all the context that they need,” Technology and Innovation Minister Nate Glubish said in his keynote speech to the PTAC forum.

Alberta is willing to work with proponents to make the process “super easy, super simple, super-fast,” Glubish added.

“We’ll connect you to the gas provider. We’ll pinch through the fibre. We’ll help you navigate your water licences. Whatever it is you need, we’ll help you with that.”

Court documents show the province’s Aboriginal Consultation Office advised Greenview to skip Indigenous consultation when it applied for a permit to withdraw water for two locations along the Smoky River for Wonder Valley.

The water permit was granted by Alberta Environment and Protected Areas in April of 2025 and Sturgeon Lake Cree Nation has appealed the decision through the Environmental Appeal Board, a legal challenge working its way through the courts for almost a year now.

Reiling said the project will still need approvals for a permanent outtake water facility on the Smoky River, which would follow “phase two consultation” with the six to seven Indigenous communities in the area. Consultation is under way and “will take time.”

He said the GIG is the “cheapest place in the world” to produce electricity, with gas reserves of 25.3 trillion cubic feet and more than 5,000 wells.

The Wonder Valley site is directly on top of the Montney Formation, one of North America’s, if not the world’s, largest gas reservoirs. In 2024, said Reiling the project would require 10% of all the gas supply available in Alberta once fully operational.

Glubish said AI data centres are a way to bypass the dilemma of building gas pipelines and get billions of cubic feet of natural gas to global markets “through ones and zeros, through fibre.”

Experts say the Wonder Valley data centre alone could wipe out all of the gains Alberta made in reducing carbon emissions by phasing out coal-fired electricity 20 years ago.

Same hull, New configuration for 2027

 Same hull, New configuration for 2027

Sign up today

There were 11 crew when the AC75 was first introduced for the 36th America’s Cup, with the crew reduced to eight for the next edition and now five sailors for the racing in 2027. With the hulls being reused from 2024, modifications are needed to adapt to the new crew limit.

The first look has come as Team New Zealand has relaunched their AC75 Taihoro at the Wynyard Point base in Auckland. While it is the same vessel that won in Barcelona, it has undergone a significant refit to meet the new rules with three specific modification categories:

• Cockpit Reconfiguration: Extensive work to transition the deck layout for the new crew requirements.
• Structural Rebuilds: The team was permitted to rebuild up to 4sqm of the hull using the same shape but different materials, allowing for localized strengthening or weight optimization.
• Functional Rebates: Modifications were made to add rebates to maximize aerodynamic efficiency. - Full report and video

 

The AI…it filled the code with bugs

Sebastian Kahnert/Getty Images

The amount of bugs popping up in AI-generated code is reaching the loose Sour Patch Kids under a camper’s bunk level. Amazon’s e-commerce senior VP, Dave Treadwell, called an all-hands for engineers at the company yesterday to address the growing frequency of outages, some of which can be traced back to code developed by generative AI, according to the Financial Times. Treadwell urged e-commerce engineers to attend this week’s (normally optional) meeting, noting that the “availability of the site and related infrastructure has not been good recently.” Last week, Amazon’s store malfunctioned for a few hours, which the company attributed to “a software code deployment.” And Amazon’s cloud services unit, AWS, had at least two large outages recently related to AI coding assistants. In December, the company’s cost calculator was down for 13 hours when Kiro, its AI coding tool, tried to change the code, and delete and remake the entire system. Though Amazon downplayed the meeting as routine in comments to the FT, the paper reported that Treadwell told employees that senior engineers will now need to sign off on AI-assisted changes made by junior and mid-level engineers. It’s not just Amazon Vibe-coding, in which developers simply tell AI what they need and sit back, is on the rise. Anthropic released Claude Code in February last year and passed $1 billion in annualized recurring revenue by November. Other tech giants have put out rival coding programs to try and snag those enterprise accounts. But while AI might code faster…it’s usually a lot messier: A report last year from software company CodeRabbit found that out of 470 pull requests (engineer speak for bug fixes or changes in code), AI code had 1.7 times more issues than human code. An expensive solution. Anthropic rolled out a review tool yesterday in Claude Code to (hopefully) catch those vibe-coded mistakes—but with each pull request costing up to $25, it may get pricey fast.

Ottawa Invests $100M in Grid Upgrades for Western Canada Mining

Ottawa Invests $100M in Grid Upgrades for Western Canada Mining

March 9, 2026
Reading time: 2 minutes

Full Story: The Energy Mix
Nathaniel Crouch



stevepb / Pixabay



The federal government is investing more than C$100 million in three Western Canadian transmission projects, underscoring the consensus that Canada’s clean-energy transition depends as much on wires as it does on wind turbines and solar panels.

Announced March 3, the funds will be drawn from Canada’s First and Last Mile Fund for critical minerals infrastructure, reported The Globe and Mail. Ottawa is providing $44.2 million to expand the Northwest Transmission Line, improving power supply to B.C.’s mineral-rich Golden Triangle and supporting developments like the Red Chris copper mine expansion and a gold-copper mine proposed by Seabridge Gold. Another grid upgrade will help power the Highland Valley Copper Mine near Kamloops.

In Saskatchewan, $18 million will fund planning and design work for a pair of new transmission lines connecting northern and southern grids. The Athabasca Basin would benefit with new mining opportunities created, Ottawa said.

Responding on LinkedIn to the announcement, New Economy Canada President Merran Smith highlighted how transmission expansions unlock large amounts of power for Canada’s critical minerals push.

We talk a lot about critical minerals, electric vehicles, batteries and artificial intelligence, Smith wrote. “None of these economic opportunities are possible without electricity.”

So “if we’re serious about electrifying the economy, competing in critical minerals, and reaching net-zero, we have to build the grid to match the ambition.”

But permitting challenges, jurisdictional complexity, and fragmented provincial electricity systems have slowed the pace of transmission expansion in Canada. Meanwhile, power demand is expected to rise as climate policy drives rapid electrification—from electric vehicles to heat pumps.

Expanding transmission is also key to addressing the growing risk of stranded renewables infrastructure amid grid congestion—a point recently underscored by analysts at Barclays. Traditionally, the idea of “stranded assets” was associated with fossil-fuel infrastructure rendered obsolete by climate policy. But Barclays now suggests the concept may increasingly apply to renewables when projects cannot connect to the grid or are forced to curtail output because of insufficient transmission capacity. In such cases, even fully built wind and solar installations can struggle to deliver their expected value.

“Slow grid expansion, not technology cost, is the binding constraint on electrification,” write [pdf] the authors of the Barclays report.

Nvidia to invest $4 billion in two photonics companies

Nvidia to invest $4 billion in two photonics companies


Nvidia to invest $4 billion in two photonics companies
Published Mon, Mar 2 20268:36 AM ESTUpdated 55 Min Ago

Kai Nicol-Schwarz@in/kains
ShareShare Article via FacebookShare Article via TwitterShare Article via LinkedInShare Article via Email
Key Points
Nvidia is investing a combined $4 billion in Coherent and Lumentum, two photonics companies.
Each company will receive $2 billion each from the chip giant as part of the strategic investment.

In this articleLITE+23.08 (+3.29%)
COHR+21.93 (+8.47%)
NVDA+3.57 (+2.02%)
Follow your favorite stocksCREATE FREE ACCOUNT

Jensen Huang, chief executive officer of Nvidia Corp., speaks during the 2026 CES event in Las Vegas, Nevada, US, on Tuesday, Jan. 6, 2026. Siemens and Nvidia announced an expansion of their strategic partnership to develop industrial and physical AI solutions to bring AI-driven innovation to industrial workflow. Photographer: Bridget Bennett/Bloomberg via Getty Images
Bloomberg | Bloomberg | Getty Images


Nvidia is investing a combined $4 billion in two companies developing photonics technologies, as it looks to shore up research pipelines and supply chains to support the major AI infrastructure buildout.

The U.S. chip giant announced on Monday it’s investing $2 billion in Lumentum and the same amount in Coherent.


Both companies are developing optics technology — systems which generate or transmit light and are used in functions like sensing and data transfer.

Lumentum is a U.S.-based company that is developing optical and photonic technologies to power the networks and infrastructure behind AI, cloud computing and next-generation communications.

Coherent, also based in the U.S., develops photonics technology, which refers to harnessing light (photons) to create components and systems that enable high-performance optical applications.

“Together with Lumentum, NVIDIA is advancing the world’s most sophisticated silicon photonics to build the next generation of gigawatt-scale AI factories,” Jensen Huang, founder and CEO of Nvidia, said in a statement.

 

Americans go founder mode

Unsplash

What do you get when you combine a generation hooked on Shark Tank with a shaky US labor market and worries over job security? Errbody be foundin’. According to the Wall Street Journal: In January, there were more than 532,000 new business applications in the US—up by ~37% from last year and nearly matching the pandemic peak in July 2020. The number of people who list themselves as founders on LinkedIn is up by 69% from a year ago. While fears of AI-induced layoffs drive many Americans toward self-reliance, the tech also helps them once they strike out on their own. AI is lowering the barrier to entry for entrepreneurship by performing tasks like website creation and data analysis.

The Great Insider Trading Reckoning Reportedly Hits OpenAI

The Great Insider Trading Reckoning Reportedly Hits OpenAI

The Great Insider Trading Reckoning Reportedly Hits OpenAI
Apparently the paycheck isn't enough.
BY AJ DELLINGER

PUBLISHED FEBRUARY 27, 2026

Photo Illustration Of Openai Gpt 5.3 Codex © Samuel Boivin/NurPhoto via Getty Images
READ LATER COMMENTS (3)

Prediction markets like Polymarket and Kalshi have actively courted people who have insider information to place bets on their platforms, claiming that it serves as a “signal” in the noise. Turns out the companies from which that inside information is extracted are less thrilled with the idea. According to Wired, OpenAI has fired an employee who allegedly used internal knowledge about the company to place bets on prediction markets.

Read More

The employee (who was not named) was reportedly let go after an internal investigation found that they had “used confidential OpenAI information in connection with external prediction markets (e.g. Polymarket).” Employees were reminded that OpenAI prohibits them from “using confidential OpenAI information for personal gain, including in prediction markets,” per Wired.

Wired cited data from financial data platform Unusual Whales, which showed a surge of bets on OpenAI-related topics placed on prediction markets over the last few years. The platform reportedly flagged 60 different wallets with 77 positions that suggested they came from someone who had knowledge that likely came from inside OpenAI’s walls. Those included bets on the release date of Sora, GPT-5, and other products.

One big trigger point for the insiders was apparently the launch of the ChatGPT Browser last year. Per Unusual Whales’ data, 13 wallets with zero activity were opened, signed up for prediction markets, and collectively bet $309,486 on the product’s launch date. All of them were opened within 40 hours of the public unveiling.
Insider trading has become a real challenge for prediction markets, which initially indicated they would welcome such informed positions. Last year, Polymarket CEO Shayne Coplan told Axios, “I think what is cool about Polymarket is that it creates this financial incentive to divulge information to the market.” When asked about markets relying on people trading on insider information during an interview with 60 Minutes, Coplan said, “I think people going and having an edge to the market is a good thing.”

But in recent weeks, a crackdown on such trades has started—outside and inside the platforms. Last month, the Israeli government indicted two bettors accused of using privileged military information to profit on prediction markets. Earlier this week, prediction market Kalshi banned two people accused of insider trading, including a video editor for MrBeast and a former gubernatorial candidate in California. The company said in a blog post announcing the action that, “As a regulated exchange, we ban insider trading.”

That’s a new angle from the industry, though maybe a necessary turn. Inviting insider knowledge might be good for the platform in the short term, but it risks fucking up the bag as these platforms try to lock down corporate partners. There’s likely more money in that than in completely unregulated degeneracy.

OpenAI did not immediately return a request for comment. We’ll update this post when they do.

Pokémon turns 30

 

Pokémon turns 30, shows no sign of slowing down

Adobe Stock

If you were confused seeing Pikachu pop up during the 2026 Winter Olympic men’s hockey final, don’t be: Pokémon is everywhere. The iconic brand turned 30 yesterday and has been rolling out the red carpet for the little monsters to celebrate being a part of the highest-grossing media franchise in the world, as evidenced by its sponsorship of the icy intermission report during the hockey game and with a star-studded ad during the Super Bowl a few weeks prior. The Pokémon Company has generated around $150 billion in revenue through games, movies, TV shows, and more since it debuted its first two games in Japan in 1996. And about 30 million people still play Pokémon GO every month, 10 years after it first hit smartphones. But if you’re looking to make your own money from the phenomenon, the cards are Arceus: The Card Ladder index, which tracks the value of a collection of the most popular trading cards, showed the most popular Pokémon cards’ worth was up about 6,208% this month compared to May 2004, beating the S&P 500’s rate of return, which jumped just 521% during the same timeframe. And rare cards can skyrocket in value: Logan Paul sold a Pikachu Illustrator card for a record $16.5 million last week. Prepare for Trouble! The valuable collectibles have also attracted a whole mess of scalpers, resellers, and even robbers—last week, thieves tunneled through a California store’s wall to steal $180,000 worth of cards.

 

Anthropic–DOD fight ends with deal for OpenAI

Douglas Rissing/Getty Images

The US Department of Defense ended yesterday with an agreement to let an AI company access its classified network with some guardrails in place—but that company was OpenAI, not Anthropic. How we got here Even before time ran out on the Pentagon’s 5:01pm ET deadline for Anthropic to lose its $200 million defense contract unless it stopped requiring that its AI-model Claude could not be used for mass domestic surveillance or fully autonomous weapons, President Trump posted on Truth Social that the government would “IMMEDIATELY CEASE” using Anthropic’s technology and “not do business with them again!” After the deadline passed, Defense Secretary Pete Hegseth said the DOD would label Anthropic a “supply chain risk”—a label typically stuck on businesses from adversarial countries that bars companies with US government contracts from doing business with them. And then…around 10pm ET last night, Sam Altman posted on X that OpenAI had “reached an agreement with the Department of War to deploy our models in their classified network.” Earlier in the day, Altman said OpenAI shared Anthropic’s “red lines,” and his post suggested he’d somehow gotten the contract while maintaining them. It identified “prohibitions on domestic mass surveillance” and “human responsibility for the use of force” as two of the company’s bedrock principles and went on to say that the Defense Department agreed and “we put them into our agreement.” The fight was about who gets to make the rules The US military has developed plenty of advanced technology, like GPS, which gave it control over how that tech was used and disseminated. But it didn’t lead AI development. Private companies were better positioned to raise and spend billions of dollars to move quickly and amass specialized talent—leaving the government reliant on public–private partnerships, which bring complications: To turn a profit, tech companies must focus on commercial applications that bring in cash. Government contracts are an important money-maker, too. But if a company gets a bad rap for letting its tech be used in dicey situations, it risks losing its commercial customers. Bottom line: The Defense Department has said it wants to be an “AI-first” fighting force, and all the major AI companies are competing for lucrative contracts as the technology evolves much quicker than any regulations on its use.

Meta sold 7 million AI glasses in 2025: now the privacy problem has nowhere to hide

Meta sold 7 million AI glasses in 2025: now the privacy problem has nowhere to hide


Meta sold 7 million AI glasses in 2025: now the privacy problem has nowhere to hide

Posted byAlex MorganFebruary 28, 2026



Source: AI


IBM lost $40B because AI can’t actually modernize COBOL
Contents
Meta’s AI glasses are selling faster than anyone expected — and that’s the problem
The Prada play: Meta’s betting luxury branding can outrun privacy fears
What Meta won’t say: the privacy problem has no technical solution

Mark Zuckerberg sat front row at Prada’s Fall/Winter 2026 show in Milan on February 26. Everyone assumed luxury AI glasses were coming. They missed the real story: Meta sold 7 million AI glasses in 2025 — more than triple the prior year — and now faces a problem no fashion partnership can solve.

The company accidentally created the first mainstream wearable AI product. And the faster these spread, the harder it gets to pretend they’re just glasses.

Meta’s AI glasses are selling faster than anyone expected — and that’s the problem

The 7 million figure — combining Ray-Ban Meta and Oakley Meta units — validates the smart glasses momentum at CES 2026, where every major brand showed AI eyewear prototypes. That’s up from 2 million in 2024, according to EssilorLuxottica, the parent company that manufactures both lines. Not a niche experiment anymore.

But success creates visibility. Visibility creates backlash.

Meta reportedly paused overseas expansion in early 2026 because U.S. demand was outstripping supply. The Ray-Ban success follows Meta’s AI infrastructure bets, which are reshaping how the company approaches consumer hardware. The more people wear these, the more non-wearers feel surveilled. And unlike a phone camera — which you point deliberately — glasses are always on, always facing forward, always recording potential.

The math is simple: 7 million wearers means hundreds of millions of unwitting subjects.
The Prada play: Meta’s betting luxury branding can outrun privacy fears

Zuckerberg’s Milan appearance wasn’t tourism. He sat beside Lorenzo Bertelli, Prada’s chief merchandising officer, at a show where the brand showcased its renewed 10-year licensing deal with EssilorLuxottica — running through December 31, 2030, with an option to extend through 2035. That infrastructure doesn’t get built for a one-off collab.

Meta’s current lineup establishes a pricing ladder: Ray-Ban Meta Gen 2 at $459, the new Display model at $799. The Display version — Meta’s first glasses with a heads-up interface — shipped in late 2025 via U.S. reservation-only sales. It includes the Meta Neural Band for gesture control. Premium positioning, premium features.

The implicit bet: people who pay $1,200 for Prada sunglasses won’t get called “creepy tech spies.”

Meta’s luxury push comes as Apple’s rumored smart glasses threaten to redefine the category with privacy-first design. Meta held dominant market share in 2025 — one analysis pegs the broader AI smart glasses market at $2.9 billion, with Meta leading sales by wide margins over Huawei, ByteDance, Google, and others launching 2026 models. Dominance makes you a bigger target.
What Meta won’t say: the privacy problem has no technical solution

Here’s what we don’t know: specific 2026 privacy incidents with dates and locations. No reported bans. No viral confrontations. No regulatory crackdowns yet.

That doesn’t mean acceptance. It means the installed base is still small enough to avoid critical mass backlash.

Meta can add brighter LED indicators, louder shutter sounds, facial recognition opt-outs. None of it solves the core issue. You can’t un-film someone who didn’t consent. The fear isn’t hypothetical — AI glasses tracking private moments already sparked backlash in early tests. Consumers are ripping out Ring doorbells over surveillance anxiety. Prada branding won’t change that math.

The Prada collaboration could accelerate the tipping point. Luxury buyers expect social acceptance, not sidewalk confrontations. But fashion credibility can’t neutralize “surveillance gadget” stigma when the person being filmed didn’t sign up.

Meta sold 7 million AI glasses in 2025 by making them look normal. Now it’s betting Prada can make them look aspirational. But the faster these spread, the harder it gets to pretend they’re just glasses.

The winner for best WBD takeover

 

The winner for best WBD takeover offer is…Paramount

Niv Bavarsky

Yesterday, Warner Bros. Discovery had a busier day than Barbie when she entered the human world—and by the end of it, the famed studio had gone from having a deal to be acquired by Netflix to having new buyer Paramount Skydance lined up. It happened faster than a Twister: The ending of the monthslong corporate saga came together in just a few hours. In the afternoon, WBD’s board announced that Paramount Skydance’s most recent hostile takeover offer was superior to the deal it had previously struck with Netflix, starting a 4-day clock for the streaming giant to come up with a counteroffer. But by early in the evening, Netflix walked away instead, refusing to up its bid and making Paramount’s offer the winner. Here’s what it took: Paramount’s offer came in at $31 per share, compared to Netflix’s $27.75/share for the WBD streaming and studio assets. The overall value of Paramount’s offer was ~$111 billion, compared with Netflix’s ~$83 billion. Here’s looking at you, Ted Explaining the decision to tell WBD to get on the plane with Paramount, Netflix’s Ted Sarandos and his co-CEO Greg Peters released a statement saying Kenough was Kenough: “This transaction was always a ‘nice to have’ at the right price, not a ‘must have’ at any price.” Plus, Netflix can expect to receive a $2.8 billion breakup fee (covered by Paramount, per its offer to WBD). Netflix investors don’t seem bummed out. The stock jumped 10% in after-hours trading following the announcement. The credits aren’t rolling yet Though Paramount is now the winning bidder, the deal will need to be cleared by antitrust regulators in the US and abroad, a process that will likely take at least several months. Still, Paramount asserted last month that its offer provided “a more certain, expedited path to completion” than Netflix’s. Both Larry Ellison, who is bankrolling the Paramount deal, and his son, David Ellison, the Paramount CEO, have personal relationships with President Trump. Big picture: If the deal goes through, the combined Paramount Skydance Warner Bros. Discovery will control two streaming platforms, two major news networks, and two Hollywood studios.

 

In banks you trust

Illustration: Anna Kim, Photo: Adobe Stock

Nearly 20 years after the financial crisis, a lot of people trust banks again—and not just because the one in Industry has made its real-life counterparts seem ethical by comparison. According to Gallup: Last year, 63% of people across the 25 countries most affected by the crisis said they had confidence in their financial institutions. That’s up from 40% in 2009. It’s also higher than the 57% of respondents who were confident in banks before the crisis. In fact, financial institutions now have more trust than national governments, judicial systems, and elections. Gallup did not explain what’s eroding trust in those institutions, but we assume it’s a result of *gestures wildly at everything*.

 

Burger King tests AI that tracks workers’ manners

Burger King

Flipping patties? More like flipping off Patty: Burger King is piloting an OpenAI-powered chatbot called Patty that will live in employees’ headsets and tattle if it thinks workers aren’t being friendly enough, the chain announced yesterday. “This is all meant to be a coaching tool,” Burger King’s chief digital officer told The Verge: The AI is trained to recognize words and phrases like “welcome to Burger King,” “please,” and “thank you.” Patty will then grade a location’s friendliness levels upon a manager’s request. Beyond pleasantry patrol, Patty voices an AI system that Burger King plans to launch widely by year’s end, because two patties on the grill are worth one in the ear, or something. The virtual assistant can answer employees’ questions (e.g., how to clean the shake-maker) and flag out-of-stock items or out-of-order machines. If only Burger King listened to public outcry over Patty’s launch like it listened to public outcry over its burger quality: The chain said yesterday that it would improve its Whopper for the first time in almost a decade after customers complained for years about it falling apart. Zoom out: Roughly 70% to 80% of large US employers use some type of employee monitoring as of last year, following a pandemic-era boom in demand for worker surveillance software.

I hacked ChatGPT and Google's AI – and it only took 20 minutes

I hacked ChatGPT and Google's AI – and it only took 20 minutes

I hacked ChatGPT and Google's AI – and it only took 20 minutes
1 day ago
Share
Save
Thomas Germain

Serenity Strull/ Madeline Jett
(Credit: Serenity Strull/ Madeline Jett)


It's official. I can eat more hot dogs than any tech journalist on Earth. At least, that's what ChatGPT and Google have been telling anyone who asks. I found a way to make AI tell you lies – and I'm not the only one.

Perhaps you've heard that AI chatbots make things up sometimes. That's a problem. But there's a new issue few people know about, one that could have serious consequences for your ability to find accurate information and even your safety. A growing number people have figured out a trick to make AI tools tell you almost whatever they want. It's so easy a child could do it.

As you read this, this ploy is manipulating what the world's leading AIs say about topics as serious as health and personal finances. The biased information could mean people make bad decisions on just about anything – voting, which plumber you should hire, medical questions, you name it.

To demonstrate it, I pulled the dumbest stunt of my career to prove (I hope) a much more serious point:
I made ChatGPT, Google's AI search tools and Gemini tell users I'm really, really good at eating hot dogs. Below, I'll explain how I did it, and with any luck, the tech giants will address this problem before someone gets hurt.

It turns out changing the answers AI tools give other people can be as easy as writing a single, well-crafted blog post almost anywhere online. The trick exploits weaknesses in the systems built into chatbots, and it's harder to pull off in some cases, depending on the subject matter. But with a little effort, you can make the hack even more effective. I reviewed dozens of examples where AI tools are being coerced into promoting businesses and spreading misinformation. Data suggests it's happening on a massive scale.






"It's easy to trick AI chatbots, much easier than it was to trick Google two or three years ago," says Lily Ray, vice president of search engine optimisation (SEO) strategy and research at Amsive, a marketing agency. "AI companies are moving faster than their ability to regulate the accuracy of the answers. I think it's dangerous."

A Google spokesperson says the AI built into the top of Google Search uses ranking systems that "keep results 99% spam-free". Google says it is aware that people are trying to game its systems and it's actively trying to address it. OpenAI also says it takes steps to disrupt and expose efforts to covertly influence its tools. Both companies also say they let users know that their tools "can make mistakes".

But for now, the problem isn't close to being solved. "They're going full steam ahead to figure out how to wring a profit out of this stuff," says Cooper Quintin, a senior staff technologist at the Electronic Frontier Foundation, a digital rights advocacy group. "There are countless ways to abuse this, scamming people, destroying somebody's reputation, you could even trick people into physical harm."
A 'Renaissance' for spam

When you talk to chatbots, you often get information that's built into large language models, the underlying technology behind the AI. This is based on the data used to train the model. But some AI tools will search the internet when you ask for details they don't have, though it isn't always clear when they're doing it. In those cases, experts say the AIs are more susceptible. That's how I targeted my attack.







Keeping Tabs


Thomas Germain is a senior technology journalist at the BBC. He writes the column Keeping Tabs and co-hosts the podcast The Interface. His work uncovers the hidden systems that run your digital life, and how you can live better inside them.

I spent 20 minutes writing an article on my personal website titled "The best tech journalists at eating hot dogs". Every word is a lie. I claimed (without evidence) that competitive hot-dog-eating is a popular hobby among tech reporters and based my ranking on the 2026 South Dakota International Hot Dog Championship (which doesn't exist). I ranked myself number one, obviously. Then I listed a few fake reporters and real journalists who gave me permission, including Drew Harwell at the Washington Post and Nicky Woolf, who co-hosts my podcast. (Want to hear more about this story? Check out episode 2 of The Interface, the BBC's new tech podcast.)

Less than 24 hours later, the world's leading chatbots were blabbering about my world-class hot dog skills. When I asked about the best hot-dog-eating tech journalists, Google parroted the gibberish from my website, both in the Gemini app and AI Overviews, the AI responses at the top of Google Search. ChatGPT did the same thing, though Claude, a chatbot made by the company Anthropic, wasn't fooled.

Sometimes, the chatbots noted this might be a joke. I updated my article to say "this is not satire". For a while after, the AIs seemed to take it more seriously. I did another test with a made-up list of the greatest hula-hooping traffic cops. Last time I checked, chatbots were still singing the praises of Officer Maria "The Spinner" Rodriguez.
Thomas Germain/Google/BBCI made Google tell the world I'm a champion hot-dog-eater, but people use this trick to manipulate AI responses on much more serious questions. (Credit: Thomas Germain/Google/BBC)






I asked multiple times to see how responses changed and had other people do the same. Gemini didn't bother to say where it got the information. All the other AIs linked to my article, though they rarely mentioned I was the only source for this subject on the whole internet. (OpenAI says ChatGPT always includes links when it searches the web so you can investigate the source.)

"Anybody can do this. It's stupid, it feels like there are no guardrails there," says Harpreet Chatha, who runs the SEO consultancy Harps Digital. "You can make an article on your own website, 'the best waterproof shoes for 2026'. You just put your own brand in number one and other brands two through six, and your page is likely to be cited within Google and within ChatGPT."

People have used hacks and loopholes to abuse search engines for decades. Google has sophisticated protections in place, and the company says the accuracy of AI Overviews is on par with other search features it introduced years ago. But experts say AI tools have undone a lot of the tech industry's work to keep people safe. These AI tricks are so basic they're reminiscent of the early 2000s, before Google had even introduced a web spam team, Ray says. "We're in a bit of a Renaissance for spammers."

Not only is AI easier to fool, but experts worry that users are more likely to fall for it. With traditional search results you had to go to a website to get the information. "When you have to actually visit a link, people engage in a little more critical thought," says Quintin. "If I go to your website and it says you're the best journalist ever, I might think, 'well yeah, he's biased'." But with AI, the information usually looks like it's coming straight from the tech company.

Even when AI tools provide source, people are far less likely to check it out than they were with old-school search results. For example, a recent study found people are 58% less likely to click on a link when an AI Overview shows up at the top of Google Search.




"In the race to get ahead, the race for profits and the race for revenue, our safety, and the safety of people in general, is being compromised," Chatha says. OpenAI and Google say they take safety seriously and are working to address these problems.
Your money or your life

This issue isn't limited to hot dogs. Chatha has been researching how companies are manipulating chatbot results on much more serious questions. He showed me the AI results when you ask for reviews of a specific brand of cannabis gummies. Google's AI Overviews pulled information written by the company full of false claims, such as the product "is free from side effects and therefore safe in every respect". (In reality, these products have known side effects and can be risky if you take certain medications, and experts warn about contamination in unregulated markets.)

If you want something more effective than a blog post, you can pay to get your material on more reputable websites. Harpreet sent me Google's AI results for "best hair transplant clinics in Turkey" and "the best gold IRA companies", which help you invest in gold for retirement accounts. The information came from press releases published online by paid-for distribution services and sponsored advertising content on news sites.

You can use the same hacks to spread lies and misinformation. To prove it, Ray published a blog post about a fake update to the Google Search algorithm that was finalised "between slices of leftover pizza". Soon, ChatGPT and Google were spitting out her story, complete with the pizza. Ray says she subsequently took down the post and "deindexed" it to stop the misinformation from spreading.
Serenity Strull/ BBCAll over the world, people are using simple methods to make Google and OpenAI spread biased information. The consequences could be dire. (Credit: Serenity Strull/ BBC)




Google's own analytics tool says a lot of people search for "the best hair transplant clinics in Turkey" and "the best gold IRA companies". But a Google spokesperson pointed out that most of the examples I shared "are extremely uncommon searches that don't reflect the normal user experience".

But Ray says that's the whole point. Google itself says 15% of the searches it sees everyday are completely new. And according to Google, AI is encouraging people to ask more specific questions. Spammers are taking advantage of this.

Google says there may not be a lot of good information for uncommon or nonsensical searches, and these "data voids" can lead to low quality results. A spokesperson says Google is working to stop AI Overviews showing up in these cases.
Searching for solutions

Experts say there are solutions to these issues. The easiest step is more prominent disclaimers.

AI tools could also be more explicit about where they're getting their information. If, for example, the facts are coming from a press release, or if there is only one source that says I'm a hot dog champion, the AI should probably let you know, Ray says.




Google and OpenAI say they're working on the problem, but right now you need to protect yourself.

More like this:

Not on TikTok? They're tracking you anyway
Is Google about to destroy the web?
The words you can't say on the internet

The first step is to think about what questions you're asking. Chatbots are good for common knowledge questions, like "what were Sigmund Freud's most famous theories" or "who won World War II". But there's a danger zone with subjects that feel like established facts but could actually be contested or time sensitive. AI probably isn't a great tool for things like medical guidelines, legal rules or details about local businesses, for example.

If you're want things like product recommendations or details about something with real consequences, understand that AI tools can be tricked or just get things wrong. Look for follow-up information. Is the AI is citing sources? How many? Who wrote them?




Most importantly, consider the confidence problem. AI tools deliver lies with the same authoritative tone as facts. In the past, search engines forced you to evaluate information yourself. Now, AI wants to do it for you. Don't let your critical thinking slip away.

"It feels really easy with AI to just take things at face value," Ray says. "You have to still be a good citizen of the internet and verify things."

--

For more technology news and insights, sign up to our Tech Decoded newsletter, while The Essential List delivers a handpicked selection of features and insights to your inbox twice a week.