What can I use mainframe-based AI for?

It’s a funny old world. On the one hand you have people talking about AI replacing just about everyone and doing their jobs faster and more accurately. And, on the other hand, you have people talking about how just about everyone over 50 is leaving full-time employment and taking up more fulfilling occupations. Or else they are talking about just how boring their job is. It seems to me that the initial focus of AI should be on being able to do the work that no-one really wants to do – don’t you think?

The good news, in that respect, is that IBM’s much publicized watsonx enterprise AI platform is doing just that. Now available is the watsonx Code Assistant for Z. It’s built on a 20 billion parameter foundation AI model, and was trained on 1.5 trillion tokens of data, and is aware of 115 coding languages.

The problem that is being addressed is the fact that the majority of business applications running on a mainframe were written in COBOL, whereas the majority of programs running on cloud-based platforms are written in some other, more modern language, eg Java. For those mainframe sites seduced by the term modernization (who said mainframes aren’t modern?) and wanting to move their business applications into the cloud, they want to rewrite those existing COBOL applications. The problem is that very very few programmers view rewriting large pieces of COBOL applications in Java as anything more than a poisoned chalice. It’s not something they would view as an interesting or pleasurable way to spend their time. Things are made even worse by the fact the original program code – with any original documentation – has probably long ago disappeared.

That’s where Code Assistant for Z comes in. It’s a generative AI product built on the watsonx enterprise AI platform, which can help developers translate mainframe COBOL applications into Java. IBM's selling point is that the AI tool offers improved testing, faster re-writing of functionality into Java, and lower costs associated with updating the old COBOL code. Code Assistant provides automated testing processes as well, and can be used in each step of the ‘modernization’ process, converting the existing COBOL code to Java.

In addition to watsonx Code Assistant for Z, IBM previously announced Code Assistant for Red Hat Ansible Lightspeed, and plans to launch new product-focused versions to address other languages and improve time-to-value for modernization. IBM is also saying that the products will address the shortage of skilled developers that currently exists.

I talked about the latest Cost of a Data Breach Report from IBM Security back in August. I thought I’d just highlight what that report said about AI. Before we look at that, just a reminder that the survey found that the length of time it takes to identify a breach is 204 days, and once a breach has been identified it takes an organization, on average, 73 days to recover. The worldwide average cost of a data breach is US$4.45 million.

The report makes a strong case for the use of security AI, saying that organizations with extensive use of security AI and automation identified and contained a data breach 108 days faster than organizations that didn’t use AI or automation. What falls into that category includes the use of AI, machine learning, automation, and orchestration to augment or replace human intervention in detection and investigation of threats as well as the response and containment process. On the opposite end of the spectrum are processes driven by manual inputs, often across dozens of tools and complex, non-integrated systems, without data shared between them.

In addition, there were cost savings with AI and automation. The report found a US$1.76 million lower data breach costs compared to organizations that didn’t use security AI and automation capabilities.

There’s a lot of talk about the downside of AI, in fact, I’ve even written about it, but like all technologies that revolutionize the way people work and live, it has a positive side and a negative side. All organizations need to have an AI policy in place to ensure that employees are not using AI in any way that could harm the company. And, there is the possibility that AI could take away people’s jobs. I like to think, like the introduction of PCs into organizations which took away the typing pool and many office secretary jobs, it will also create new types of job, and the overall number of jobs available will actually increase.

Also looking on the positive side, things like Code Assistant are able to do jobs where there is a shortage of people who would otherwise be available to do it (ie developers), and it will do work that most programmers would rather not have to do (ie rewrite COBOL programs in Java).

The whole Code Assistant for Z approach by IBM seems a great step forward in the use of safe AI.

I think I know about AI, but what is actual intelligence?

So many people are talking about Artificial Intelligence, I thought it would be useful to see what psychologists think about natural intelligence. It’s a term that we all think we know the meaning of, but what is it that those people working in that field would be able to identify or recognize as intelligence?

Like all good philosophy essays, let’s start with a definition of intelligence. Intelligence is: “the ability to acquire and apply knowledge and skills”. Or: “the ability to solve complex problems or make decisions with outcomes benefiting the actor”. Or: “the capacity or ability to acquire, apprehend, and apply knowledge in a behavioural context”. So, we’re looking at acquiring information and applying that information.

It’s also been suggested that intelligence gives humans the cognitive abilities to learn, form concepts, understand, and reason, including the capacities to recognize patterns, innovate, plan, solve problems, and employ language to communicate.

In psychology, there have been various theories about what intelligence actually is and attempts to measure it.

Psychometric theories treat intelligence as a composite of abilities measured by mental tests that measure reasoning ability and memory. Tests can be given to people and a numerical result can be produced.

Spearman found that people who do well on one type of test generally do well on other types. Using factor analysis, he suggested there were two kinds of factor underlying all differences in test scores. Firstly, there was a general factor, which he labelled ‘g’, and a second factor specifically related to the type of task.

On the other hand, Thurstone proposed seven ‘primary mental abilities’. They were: verbal comprehension; verbal fluency; number; spatial visualization; inductive reasoning; memory; and perceptual speed.

Vernon and Cattell modelled intellectual abilities as hierarchical, with g (general ability) at the top, and specific abilities below. Cattell also suggested that general ability can be subdivided into ‘fluid’ and ‘crystallized’, where fluid abilities are the reasoning and problem-solving abilities measured by tests, and crystallized abilities include vocabulary, general information, and knowledge about specific fields.

Cognitive psychologists didn’t go along with these ideas, they thought that it was important to understand the processes underlying intelligence. They assumed that intelligence comprises mental representations (such as propositions or images) of information and processes that can operate on such representations.

Hunt, Frost, and Lunneborg suggested that basic cognitive processes are the building blocks of intelligence.

Many of the experiments assumed that humans processed information sequentially or serially. However, they may well process information in chunks and in parallel. And there may be cultural differences.

Cognitive-contextual theories looked at how cognitive processes operate in various settings. Gardner proposed a theory of ‘multiple intelligences’, including linguistic, logical-mathematical, spatial, musical, bodily-kinaesthetic, interpersonal, and intrapersonal intelligence.

Sternberg proposed a ‘triarchic’ theory. He thought that musical and bodily-kinaesthetic abilities were talents rather than intelligences. Sternberg’s three integrated and interdependent aspects of intelligence were: practical (the ability to get along in different contexts), creative (the ability to come up with new ideas), and analytical (the ability to evaluate information and solve problems).

Biological theories of intelligence suggest that understanding intelligence is only possible by identifying its biological basis. It’s looking at neurons.

There have been studies of different areas of the brain. For example, Levy and others found that the left hemisphere is superior in analytical tasks, such as are involved in the use of language, while the right hemisphere is superior in many forms of visual and spatial tasks. Overall, the right hemisphere tends to be more synthetic and holistic in its functioning than the left. Remember that the corpus callosum links the two halves of the brain, so work was done on patients whose corpus callosum had been severed. Levy and Sperry found that the left hemisphere of the brain functioned better with patterns that are readily described in words but are difficult to discriminate visually. Whereas the right hemisphere was more adept with patterns requiring visual discrimination.

Eysenck and others looked at brain waves and speed of response in people taking intelligence tests.  Some researchers found a relationship between brain waves, and scores on a standard psychometric test of intelligence.

Others have looked at blood flow in the brain, which indicates which areas of the brain are being used. Haier found that people who perform better on conventional intelligence tests often show less activation in relevant portions of the brain than do those who perform less well.

There have been a number of studies of children showing how intelligence develops. The outstanding researcher in this area is Piaget. His four stages of cognitive development were: sensorimotor intelligence; preoperational thinking; concrete operational thinking; and formal operational thinking.

You might ask what impact environment has on intelligence? It does seem that intelligence runs in families, and according to Plomin, “recent genome-wide association studies have successfully identified inherited genome sequence differences that account for 20% of the 50% heritability of intelligence”. However, there is no single gene for intelligence. And, we know from epigenetics that through a process called methylation, genes can be turned on or off. DNA methylation is influenced by diet, exercise, stress, relationships, thoughts, nutritional status, toxins, sleep, infections, etc. So, yes, environment can affect a person’s intelligence.

What do intelligence (IQ) tests measure? Because there is no complete definition of intelligence, it would seem that IQ tests simply measure what IQ tests measure!

It’s worth noting that people also talk about Emotional Intelligence (EI), and there are EQ tests to measure how emotionally intelligent a person is. Emotional Intelligence is usually described as a person’s ability to perceive, use, understand, manage, and handle emotions. The name most associated with EI is Daniel Goleman. Some research has found that people with high EI have greater mental health, job performance, and leadership skills. There are debates about whether EI is really a form of intelligence or something else.

What can AI developers learn from natural human intelligence? That’s difficult to answer. Clearly people like Thurstone, Cattell, and Gardner (and many others) came up with lists of things that make up human intelligence and these lists might be helpful for AI developers. However, like in all things, there have been many different approaches to the question of what is intelligence? What might be of interest is an idea from Carol Dweck in her book called Mindset: The New Psychology of Success. The book suggests that some people believe their success is based on innate ability; these people are said to have a ‘fixed’ theory of intelligence (ie a fixed mindset). Other people believe their success is based on hard work, learning, training, and doggedness; these are said to have a ‘growth’ or an ‘incremental’ theory of intelligence (growth mindset). And everyone else is meant to be somewhere on a continuum between the two extremes. Perhaps the one thing to takeaway is that a successful AI needs to have a growth mindset.

 

Mainframes and the world of cyber-crime

Mainframe security is a concern for all mainframe-using organizations. However, many people working with mainframes are unaware of just how professional hacker groups are. Some people still have the idea that a hacker is some kind of disaffected teenager who plays at accessing corporate data. The truth is that hacker gangs are using the same tactics, techniques, and procedures (TTPs) as legitimate businesses. Plus, they are able to offer various hacking techniques as-a-Service. This means almost anyone can use them to hack your mainframe.

Cyber-crime allows criminal gangs to make huge profits, which means that there has been a massive growth in their activity and the underground marketplace where products and services can be bought and sold. Most IT people are familiar with the idea of Ransomware-as-a-Service (RaaS), but not all bad actors are looking to steal sensitive data, which they can sell, or extort money through ransomware attacks. Some bad actors are looking to steal processing power in order to mine cryptocurrency. Some simply gain access to a corporate network and sell that access to others. These are called initial access brokers (IABs). You can also find Crypter-as-a-Service (CaaS) and Malware-as-a-Service (MaaS) available to purchase.

Any IT security team has to be prepared for hackers, or more likely hacking gangs, to use encrypted anonymous routing tools (eg tor and I2P). When the gangs extract money from an organization, it can be hard to trace because of the use of cryptocurrency. On top of that, there are state-sponsored actors, who are not necessarily in business for the money, but are politically motivated in their attacks.

With the Ransomware-as-a-Service model, a hacker gang will create ransomware tools, infrastructure, and operating procedures or playbooks. Other people or gangs can then pay to access these tools etc and then carry out a ransomware attack. It’s a bit like shopping. The purchasers may use RaaS tools from multiple gangs, and what they do with them can vary. This makes identification harder because the users will have different TTPs. The benefit of this model for the users is that they have a tried and tested way to make money from legitimate organizations. The benefit for the gang that created the RaaS is that they can be making money without getting out of bed in the morning!

One of the first thing that hacker gangs do, is create backdoors into the network that they have just hacked. That means they can easily get back into that network in the future. It also means that they could sell this access to other people. Initial access brokers (IABs) make their money by selling access to victim networks on the dark web. They will have spent time gaining access in the first place, whereas the purchasers don’t need to spend any time before they start to attack their chosen target. Preferred methods of gaining access to an organization include: compromised emails; cloud misconfigurations; and software supply chain attacks.

Before we look at Crypter-as-a-Service, it’s useful to understand the three stages in a typical malware attack. Stage 1 is the dropper. This is the initial malicious file/command that retrieves the crypter. In stage 2, the crypter, which is a tool or process, obfuscates the malware payload so it can bypass the defences on the network. Stage 3 is the malware that supplies the functionality required by the attacker. This is typically some kind of remote administration. Antivirus and antimalware software is used to prevent crypters getting on to a network, and both sides are regularly updating their software in an unending battle.

Crypter-as-a-Service (CaaS) provides the latest generation of software tools and services would-be hackers can include in their workflows, without them needing to be completely up to date with the latest requirements. These bad actors may also, at the same time, purchase Malware-as-a-Service (MaaS).

Malware needs to be kept up to date to avoid detection, which makes Malware-as-a-Service such a popular purchase for less technically adept hackers. They may also purchase support contracts, access to updates, and affiliated services.

Obviously, these techniques are used on non-mainframe platforms. The reason that mainframers need to be aware of them is that mainframes are no longer separate islands of computing. They are increasingly being connected to the cloud, and the latest Cost of a Data Breach Report from IBM Security found that 82% of breaches involved data stored in the cloud – public, private, or multiple environments. Mainframe sites that have projects that embrace cloud computing may well wish to review their security policy for the cloud. The report goes on to say that 39% of breaches spanned multiple environments. In addition, mainframe APIs are often connected to mobile devices and the web. It makes reviewing the potential attack surface an important job.

What I’m suggesting is that mainframe breaches could be started from a different platform within an organization and then moved onto the mainframe. Criminal gangs, state sponsored actors, and even disgruntled staff could now be taking steps (if they haven’t already) to access your mainframe data.

You can read more in The Professionalization of Cyber Crime whitepaper from WithSecure.

Using AI for business success

Let’s jump forward in time, say five years, where AI is everywhere. What does our mainframe world look like? Let’s start with programming. Working programs are being completed by the next day! A programmer simply says to the programming AI what the program needs to achieve and what language the program should be written in, and within minutes (seconds for simpler programs) the program is written and compiled. The programmer then tests it and deploys it.

Reports still need to be produced. You simply tell the AI what it needs to report on, and the AI writes it for you. A quick check on the content is all that’s needed before it’s distributed.

Rather than needing a security team to monitor the mainframe, cloud, and other platforms, the AI can do that. It can keep an eye on who is making any changes. It can send an alert if someone is working from an unusual IP address to make changes. It might even take action such as locking out the user or suspending a job. It can check whether people are accessing files that are not associated with their job role. And it can identify if user-ids and passwords suddenly become active after a period of dormancy. It will protect your platforms against attempts to breach security.

It will make life so much simpler – or, in many ways, deskill the work that is being done. So, should we start working towards this computing nirvana now? As with most things, the dream and the reality are not the same.

While there are plenty of AI projects out there at the moment, and I’ve written about IBM’s AI work previously, it’s probably ChatGPT that most people are familiar with. ChatGPT is an example of a Large Language Model (LLM). It’s a bit like the predictive text you use when messaging someone on your phone. ChatGPT has been trained on a massive amount of data. It can then summarize what it knows and generate text (including poetry!). You may see the term generative AI to describe the ability to generate text.

While ChatGPT is very clever and very useful, and, I must say, quite fun to use, organizations may find that it’s not quite as clever as they thought. Rather than doing their own research, some people may, for reasons of speed, rely on LLMs to give them an answer to a problem they are facing. However, because of the size of the dataset that the LLM was trained on, it may contain conflicting information. It may also not contain the most recent information available. As a consequence, the seemingly all-knowing LLM may not be quite giving you the best advice. In addition, depending on the question, there may be factors that the LLM can’t take into account.

Another issue faced at some organizations is when some members of staff are using ChatGPT to get information or solve problems etc. Sometimes, the information that they are giving the LLM may be covered by non-disclosure agreements, or be proprietary (eg getting the LLM to debug some code), or company confidential. They consider talking to the AI from their laptop is a bit like talking to a doctor or lawyer, and the information they give goes no further. What usually happens is that the data entered become part of the LLM’s training data. And that means it may appear in the answers given to your organization’s competitors. With GDPR, CCPA, and similar regulations, if someone were to enter personally identifiable information (PII), that might lead to quite hefty fines.

Three things immediately come out of this. Firstly, all staff at an organization need to be made aware of the dangers of entering company confidential information into an LLM or violating privacy laws. The second thing is the need for companies to draft an LLM use policy and implement it.

Thirdly, there is the ongoing issue of shadow IT. With a mainframe, you pretty much know what applications people are using. The issue comes with groups withing an organization making use of applications available in the cloud or using apps on their phones that IT hasn’t checked for security. For any organization, there may well be individual members of staff or whole teams that are using ChatGPT or similar LLMs for their work. Because of the issues mentioned above, this can lead to loss of data or fines, etc.

Highlighting the concerns that people have with AI, just recently, following the publication of the National Risk Register (NRR) 2023, AI has been officially classed as a security threat. The document details the various threats that could significantly impact the UK’s safety, security, or critical systems at a national level. AI is now described as a ‘chronic risk’, highlighting the long-term threat that it poses.

AI is already with us. It is really useful, and my IT nirvana prediction is probably true. It’s just getting there from here is going to be a bumpy road. If you like metaphors, we’re in the situation where we’ve just given our teenager the car keys to our new vehicle.

 

 

Security breach – it’ll never happen! Part 2

This time we continue our look at IBM Security’s latest Cost of a Data Breach Report.

I thought that it would be useful to see what recommendations the report had for busy IT security teams.

37% of ransomware victims opted not to involve law enforcement to help contain a ransomware breach, but those that did experienced a less costly ransomware breach overall. The average cost of a ransomware breach was US$5.11 million when law enforcement wasn’t involved and US$4.64 million when law enforcement was involved – a 9.6% difference.

The total amount of time to identify and contain a ransomware breach was 33 days shorter with law enforcement involvement, at 273 days in total compared to 306 days (a saving of 11.4%). The mean time to contain a ransomware breach was 63 days or 23.8% shorter with law enforcement involvement compared to 80 days without.

For organizations that experienced a ransomware attack, those that used automated response playbooks or workflows designed specifically for ransomware attacks were able to contain them in 68 days compared to the average of 80 days for organizations without automated response playbooks or workflows (16% less).

Does paying the ransom actually save your organization any money? The report suggests that the savings are minimal. Their findings were that the cost of a ransomware attack for an organization that paid the ransom was US$5.06 million. If the organization didn’t pay the ransom, the cost was US$5.17 million – a difference of 2.2%. However, the figures don’t include the cost of the ransom itself. The report suggests that paying the ransom is probably not a cost-effective strategy overall.

The report strongly makes the case for the use of security AI, saying that organizations with extensive use of security AI and automation identified and contained a data breach 108 days faster than organizations that didn’t use AI or automation. What falls into that category includes the use of AI, machine learning, automation, and orchestration to augment or replace human intervention in detection and investigation of threats as well as the response and containment process. On the opposite end of the spectrum are processes driven by manual inputs, often across dozens of tools and complex, non-integrated systems, without data shared between them.

In addition, there were cost savings with AI and automation. The report found a US$1.76 million lower data breach costs compared to organizations that didn’t use security AI and automation capabilities.

Perhaps not surprisingly, the report found that 51% of organizations are planning to increase their security investments as a result of a breach – although one must worry about the other 49%. For those who are planning to invest, the top areas identified included incident response (IR) planning and testing, employee training, and threat detection and response technologies.

The report recommends that organizations take a DevSecOps approach tin order to build security into any tools or platforms an organization depends on to engage its workforce or its customers. Organizations of all types, the report says, should look to ensure that security is at the forefront of the software they’re developing as well as commercial off-the-shelf software that they’re deploying. Application developers must continue to accelerate the adoption of the principles of secure by design and secure by default to ensure that security is a core requirement that’s considered during the initial design phase of digital transformation projects and not simply addressed after the fact. The same principles must be applied to cloud environments to support cloud-native app development in order to makes a serious effort to protect user privacy and minimize attack surfaces.

The report recommends application testing or penetration testing from the perspective of an attacker in order to give organizations the opportunity to identify and patch vulnerabilities before they turn into breaches. No technology or application will ever be fully secure, and adding more features introduces new risks. Ongoing application testing can help organizations identify new vulnerabilities.

The report suggests that organizations should strengthen their resiliency by knowing their attack surface and practicing their Incident Response (IR). Various tools can help organizations gain an attacker-informed perspective into their unique risk profile and vulnerabilities, including which vulnerabilities are readily exploitable.

Secondly, having a team in place that’s versed in the right protocols and tools to respond to an incident has been shown to significantly reduce costs and the time to identify and contain a breach. Organizations with high levels of these countermeasures in place incurred US$1.49 million lower data breach costs compared to organizations with low levels or none.

Another recommendation is for organizations to implement network segmentation practices to limit the spread of attacks and the extent of damage they can cause, strengthening overall resiliency and reducing recovery efforts.

The report also recommends that organizations modernize data protection across hybrid cloud. 82% of data breaches in the report involved data stored in cloud environments, and 39% of breaches included data that spanned multiple types of environments. The report recommends gaining visibility and control of data spread across hybrid cloud as a top priority for organizations, and should include a focus on strong encryption, data security, and data access policies.

Newer technologies such as data security posture management can help find unknown and sensitive data across the cloud, including structured and unstructured assets within cloud service providers, software as a service (SaaS) properties, and data lakes. This can help identify and mitigate vulnerabilities in underlying data store configurations, entitlements, and data flows.

Organizations also need to deploy strong identity and access management (IAM) strategies that include technologies such as multifactor authentication (MFA), with particular focus on managing privileged user accounts that have an elevated access level.

There are plenty of evidence-based suggestions in the Cost of a Data Breach Report that most sites would be wise to implement before a data breach happens to them (again) because they need to realize that a breach can definitely happen to them.

Security breach – it’ll never happen! Part 1

We all know from the press that security breaches have been causing serious problems to computing infrastructure for a number of years now. And yet, there are still too many mainframe sites that are hoping it won’t happen to them. I thought, by way of a wake-up call, it would be useful to take a look at the findings of the latest Cost of a Data Breach Report from IBM Security.

The first thing your CFO will want to know is how much a data breach is likely to cost. The report found that it is US$4.45 million, which is 2.3% higher than the 2022 report’s findings. Worryingly, only 1 in 3 sites that experienced a breach had the breach identified by their own security teams or tools. The remaining 67% of breaches were reported by a benign third party or by the attackers themselves. When the attackers disclosed a breach, it cost organizations nearly US$1 million more compared to internal detection.

The cost of a ransomware attack increased by 13% from 2022, now costing on average US$ 5.13 million. Ransomware attacks made up 24% of all data breaches recorded in the survey. Destructive attacks that left systems inoperable accounted for 25% of attacks. Business partner and software supply chain attacks accounted for 15% and 12% of attacks, respectively.

There’s always a big debate about whether an organization should disclose that it has been hacked and call in law enforcement. After all, the hackers are often based abroad, and a prosecution is unlikely. In addition, the news of the breach may reach the press and the company is very likely will lose customer confidence and is likely to lose money over the next couple of years. The report found that organizations that didn’t inform law enforcement faced an additional cost of US$ 470,000. 63% of sites in the survey had involved law enforcement, the 37% that didn’t also paid 9.6% more and experienced a 33-day longer breach lifecycle.

If you work in healthcare, the report found that since 2020, healthcare data breach costs have increased by 53.3%. For the 13th year in a row, the healthcare industry reported the most expensive data breaches, at an average cost of US$10.93 million.

The big question worrying many sites is are they currently being hacked, and they haven’t realized yet? The survey found that the length of time it takes to identify a breach is 204 days, which, although it might be cold comfort, is better than last year’s figure of 207 days. Once a breach has been identified, how long does it take to recover? The survey found that on average it takes organizations 73 days. That’s three days longer than the 2022 results.

One small comfort for traditional mainframers is that 82% of breaches involved data stored in the cloud – public, private, or multiple environments Mainframe sites that have projects that embrace cloud computing may well wish to review their security policy for the cloud. The report goes on to say that attackers often gained access to multiple environments, with 39% of breaches spanning multiple environments and incurring a higher-than average cost of US$4.75 million.

The location of an organization has big impact on the cost of a data breach. The most expensive place for a data breach is the USA, costing US$9.48 million. The Middle East is the second most expensive at US$8.07 million. Next is Canada, costing US$5.13 million. Fourth is Germany, costing US$4.67 million. And fifth is Japan costing US$4.52 million. The United Kingdom has dropped out of the top five this year.

We said Healthcare was the most expensive. The rest of the top five industries are: Financial costing US$5.90 million; Pharmaceuticals costing US$4.82 million; Energy costing US$4.78 million; and Industrial costing US$4.73 million. Technology has dropped out of this top five list.

Detection and escalation costs are still very expensive. This year the figure rose by 9.7% to US$1.58 million. These costs include activities that enable a company to reasonably detect a breach and can include forensic and investigative activities, assessment and audit services, crisis management, and communications to executives and boards.

When it comes to lost business costs, the figure dropped 8.5% to US$1.30 million. This figure includes activities such as business disruptions and revenue losses from system downtime, the cost of lost customers and acquiring new customers, and reputation losses and diminished goodwill.

This year’s report is its 18^th consecutive edition. The research is conducted independently by Ponemon Institute, and sponsored, analysed, and published by IBM Security. Responses were from 553 organizations impacted by data breaches that occurred between March 2022 and March 2023.

Next time will look at more from the report.

Apple – the evil empire?

There’s a moment in one of those films about the early days of Apple where Steve Wozniak comes up to Steve Jobs and says that he has built a new computer with umpteen holes in the back so that you can plug in just about every device that was then available. It would have made those early Apple devices the dream machine for most people. However, Steve Jobs, without any thought about the feelings of his company’s co-founder, says ‘no’. And so started the locked in, world of its own, Apple empire.

Let’s be clear, I’ve used Apple devices since the days of the Apple IIGS, through those wonderful luggable Macs, right up until a few years ago. Apple was first with a commercially-viable WIMPS (Windows, Icons, Menus, and Pointers) interface, and they created the look and feel of a modern phone. I also love the idea of a magnetic connector, so that if you trip over the wire, it simply disconnects and doesn’t pull your laptop onto the floor.

But if Apple are so good, what percentage of the worldwide PC marketplace does it have? According to IDC data in April, Apple has 7.2 percent of the worldwide PC market. According to Statista, it has 14.2% of the US PC marketplace. What about Apple phones? Firstly, I’m told, you’re not allowed to hold them like a normal phone, you have to hold them sideways, just in case not everyone in the world realizes that you’re using an Apple device. Statcounter tells us that worldwide, Apple phones have 31.5% market share, with Android phones having 67.56%. (The tiny percentage left must be people using two tin cans and a piece of string!) However, if we look at the US marketplace, 62.13% of phones sold are from Apple, with Android having just 37.47%. A huge discontinuity between the USA and the rest of the world.

Medium published an interesting story about the psychology tricks (cognitive biases) Apple use to keep punters hooked on its products. Here are the tricks listed in the article:

Using gamification to improve user engagement – this is the process of turning something dull and mundane into a game – you might do it with your three-year-old to tidy up their toys. For example, the Apple Card in your digital wallet changes colour as you spend more money. This encourages people to spend more. Apple Arcade offers games that aren’t available on any other platform, which creates a sense of exclusivity (or social isolation!). Apple rings on the Apple watch motivates people to be healthier and offers rewards as people hit milestones.

Integrating behavioural economics with product design – an example is bringing out new products with updates (often minimal). This appears to make older models obsolete. The sunk cost fallacy is where a person has spent time and money not only buying a product, but also learning how to use it. So, changing to a different product doesn’t seem worth the effort. So, once an Apple user, always an Apple user. Habits or defaults use less brain power and seem easier at the time. So, if you chose Apple last time, you’re very likely to choose an Apple product for your next purchase.

The psychology of notifications – alerts help us feel that we’re keeping up to date with what’s going on. A red number next to your email icon makes it seem urgent that you check your emails. Allowing users to tailor their notifications gives them the illusion of control.

The mere exposure effect – as anyone finding themselves humming the tune of an advert knows, familiarity makes us choose a product (or tune). So, product placement means that only the good guys in films and TV wear or use Apple products. And we’re the good guys in our life story, aren’t we?

Dopamine-driven feedback loops – this neurotransmitter motivates and rewards us. When you check your email (or anything else) and find a new email, you get a small dopamine reward. So, you repeat the activity to get another reward.

Peak-end rule – mums looking after toddlers don’t remember every dirty nappy or the floods of tears, they remember the best bits – that quite cuddle reading a book together – and the end – the child finally fast asleep. Apparently, Apple product launches have high-intensity peak moments, when a new product or feature gets announced.

Paradox of choice – it’s very hard for people to choose what jam they want if there are more than six choices available. There are too many variables to weigh up. So, Apple restricts the number of product choices it makes available.

Reduction of cognitive dissonance – if you hold contradictory views about something, you are meant to feel cognitive dissonance, which is unpleasant. So, Apple turns off comments on all its social media platforms. There’s nothing negative for customers and potential customers to see. So, there are no potentially conflicting views.

Is Apple deliberately using psychological techniques to suck in people and keep them as customers? Are all big organizations doing the same only not so well? You decide. But on the plus side, Apple has pushed forward computing on PCs, tablets, and phones. On the downside, they may well be exploiting their customers in ways that Microsoft, Google, and PC and phone manufacturers can only dream of!