News related to
software

The guidance, issued on May 25 in a 38-page blueprint, reflects growing official concern that attackers are using generative AI, large language models and autonomous tools to discover exposed systems, weaponise flaws, craft phishing lures and scale malware operations faster than conventional security programmes can respond. The document places rapid remediation, continuous monitoring and exposure reduction at the centre of enterprise cyber defence.

CERT-In’s most stringent timeline applies to known exploited vulnerabilities affecting internet-facing and critical systems, including applications, identity platforms, cloud assets, APIs, operational technology and systems supporting essential business functions. Organisations are advised to patch, mitigate or isolate such weaknesses within 12 hours where feasible. Critical externally exposed vulnerabilities should be addressed within one day, while known exploited flaws inside internal systems should be fixed within one day unless compensating controls are implemented and documented.

The blueprint also recommends that critical internal vulnerabilities affecting high-value systems be remediated within three days, and high-severity vulnerabilities within five days based on risk prioritisation. Where patches are unavailable, organisations are expected to use temporary protections such as isolation, access restrictions, web application firewalls, API shields, feature disabling and enhanced monitoring until permanent fixes are deployed.

The directive signals a shift from audit-driven cybersecurity to continuous exposure management. CERT-In has warned that organisations can no longer depend on periodic assessments or reactive incident response when automated tools can identify weak credentials, misconfigured systems, insecure APIs and vulnerable internet-facing services at machine speed. The approach requires security teams to maintain live inventories of assets, prioritise exposed systems and test whether controls work under attack conditions.

AI is changing both sides of the cyber equation. Attackers can use it to automate reconnaissance, write exploit code, refine phishing messages, generate synthetic identities and adapt malicious software. Defenders are being pushed to use similar capabilities for anomaly detection, threat hunting, automated triage and faster containment. The risk, however, is that poorly governed AI systems can themselves become attack surfaces through prompt injection, data leakage, model manipulation, poisoned training data, model theft and compromised orchestration pipelines.

The guidance gives particular weight to organisations operating in banking, financial services, telecom, healthcare, government, energy, transport, cloud services and other critical infrastructure-linked sectors. These environments often rely on interconnected digital systems, third-party software, outsourced technology providers and legacy platforms, creating wider exposure when a single flaw is weaponised quickly.

Global breach data has reinforced the urgency behind faster patching. Software vulnerability exploitation has overtaken stolen credentials as a leading breach entry point in major datasets, while ransomware remains a high-impact threat. Security teams also face growing pressure from supply-chain compromise, shadow AI usage, cloud misconfiguration and business email compromise. Unauthorised use of public AI tools has become a data governance issue as employees may upload source code, business documents, credentials or customer information into platforms outside corporate oversight.

CERT-In’s blueprint calls for a zero-trust approach, least-privilege access, layered controls and secure-by-design practices across applications, infrastructure and AI workflows. It urges organisations to maintain visibility into AI deployments, restrict sensitive data uploads to public AI platforms, log AI activity, conduct adversarial testing and keep human approval for critical autonomous actions.

Software supply-chain visibility is another major focus. Organisations are encouraged to use software bills of materials and related inventories for AI models, cryptographic assets and hardware components to understand dependencies, validate provenance and coordinate remediation when vulnerabilities emerge in third-party products.

The new expectations build on India’s existing cyber incident reporting framework, under which specified cyber incidents must be reported to CERT-In within six hours. The latest blueprint does not merely extend compliance obligations; it raises operational expectations for boards, chief information security officers and technology vendors by linking resilience to the speed of response.

Smaller organisations may struggle with the 12-hour benchmark because patch testing, downtime concerns, legacy dependencies and staffing shortages often slow remediation. The guidance therefore recognises feasible mitigation as part of the response, but it also makes clear that unmanaged exposure is no longer acceptable when attackers can exploit public-facing weaknesses within hours.

Global enterprise AI expenditure is expected to reach about $940 billion in 2026 and climb to roughly $2.1 trillion by 2029, reflecting a shift from experimental deployments to large-scale use across manufacturing, finance, logistics, health care, energy and public services. China is emerging as one of the fastest-expanding markets within that cycle, helped by heavy infrastructure spending, state-backed industrial policy and a corporate race to build domestic alternatives to foreign chips, models and cloud platforms.

The acceleration is no longer confined to model development. China’s AI buildout is moving across the full technology stack, from data centres and accelerators to enterprise software, robotics and agentic systems capable of handling complex workflow tasks. The first phase of the investment wave was dominated by computing power, foundational models and large infrastructure projects. The next phase is being shaped by applied AI, intelligent services and automation across production lines, offices and consumer platforms.

That transition is putting pressure on global rivals. US technology groups still lead in advanced chips, frontier models and hyperscale cloud capacity, but China’s market has advantages in deployment speed, manufacturing depth and policy coordination. Companies including Alibaba, Tencent, Baidu, Huawei and ByteDance are expanding AI services while also trying to reduce dependence on restricted US semiconductor supplies. Alibaba has unveiled a new AI chip through its T-Head unit and is directing tens of billions of dollars into cloud and AI infrastructure over several years. Huawei’s Ascend processors have become central to China’s domestic accelerator strategy as export controls limit access to top-tier Nvidia products.

Infrastructure remains the foundation of the race. Worldwide AI infrastructure spending is on course to exceed $1 trillion by 2029, with accelerated servers accounting for the overwhelming share. China remains the second-largest AI infrastructure market after the US, even though export restrictions have created supply constraints for high-end accelerators. Those restrictions have encouraged domestic chip design, local server ecosystems and more efficient deployment models for inference, where many commercial AI applications run after models have been trained.

China’s data centre expansion is also moving into more specialised formats. AI workloads demand dense computing power, stable electricity supply and advanced cooling, all of which are raising costs and straining grids. Projects near Shanghai and other technology hubs are testing alternative energy and cooling systems, including offshore and renewable-powered facilities. These efforts reflect a broader attempt to manage the energy burden of AI while supporting national ambitions in cloud services, industrial software and smart manufacturing.

Robotics is becoming a central pillar of the spending wave. China already has the world’s largest industrial robot base and is pushing into embodied intelligence, where AI systems are integrated into machines that operate in factories, warehouses, homes and public spaces. Forecasts for China’s robotics market point to rapid expansion over the next five years, with demand coming from electric vehicles, electronics, logistics and elder care. The combination of AI models, sensors, batteries and manufacturing scale gives domestic firms a route to compete internationally beyond software alone.

Policy support is reinforcing corporate investment. Beijing’s “AI Plus” strategy, issued in 2025, aims to embed artificial intelligence across the economy by expanding access to data, compute and talent while promoting open-source ecosystems and industrial adoption. Local governments have added funding programmes, innovation parks and procurement support, creating competition among cities such as Beijing, Shanghai, Shenzhen and Hangzhou. That model can accelerate deployment, though it also raises the risk of duplicated capacity, uneven standards and projects driven more by subsidy incentives than commercial demand.

The competitive picture remains mixed. China leads in AI publication volume, citations, patent output and industrial robot installations, while the US continues to produce more frontier models and higher-impact patents. The performance gap between leading US and Chinese models has narrowed, aided by open-source releases and engineering efficiency from Chinese labs. DeepSeek’s breakthrough earlier in the cycle demonstrated that capable systems could be produced with fewer resources than previously assumed, intensifying debate over whether raw spending alone will determine leadership.

The product, built around a personal AI assistant called Mona, is being positioned as a “local-first” alternative to cloud-based generative AI tools. Rather than routing most tasks through remote servers, MonoClaw runs large language models on a user’s own Apple hardware, with the company saying the approach is designed to keep sensitive memory, session history and credentials under the user’s direct control.

Sentimento Technologies Limited, the Hong Kong engineering studio behind the product, describes MonoClaw as the city’s first managed local AI runtime environment for professional users. Its launch comes as businesses move from experimental chatbot use towards agentic AI systems that can monitor workflows, draft responses, prepare reminders and act on user-approved instructions across multiple workplace channels.

Mona is designed to work as a digital secretary across email, WhatsApp, Telegram and calendar-linked tasks. The system can identify action items in messages, prepare reply drafts, generate morning briefings, track pending approvals, surface relevant documents before meetings and flag deadlines. The company says the product ships with 160 pre-bundled professional skills, covering both business administration and personal task management.

Billy Zuo, co-founder and chief executive of Sentimento Technologies, said the shift from manual software operation to autonomous AI execution marked a wider change in workplace computing. He said many businesses adopting cloud AI still face concerns over data leakage and unpredictable subscription costs, arguing that a local-first model gives companies greater control over sensitive information and spending.

MonoClaw’s pricing reflects that positioning. The permanent software licence is priced at HK$28,888, with an early-bird offer of HK$25,888. Users must also provide compatible Apple hardware, such as a Mac mini M4 or iMac M4, with the Mac mini starting at about HK$6,099. The company handles installation, workflow configuration and validation, with payment structured through a 40 per cent deposit and 60 per cent balance after final delivery and verification.

That model differs from many AI software products that rely on monthly subscriptions, metered token use or cloud-service plans. Sentimento is pitching MonoClaw as a capital investment rather than an operating expense, a message likely to appeal to smaller firms that want clearer budgeting and lower recurring software exposure. The trade-off is a higher upfront cost and a hardware dependency that may limit adoption among users who prefer device-neutral or fully cloud-hosted systems.

Privacy and auditability are central to the product’s commercial pitch. MonoClaw uses local contextual memory, local runtime profiles, secret redaction and explicit approval gates for higher-risk actions. Mona is designed to request confirmation through messaging channels before executing sensitive commands, data changes or external actions. That “human-in-the-loop” structure reflects a broader concern in the AI sector: agents that are powerful enough to automate work also need firm boundaries, logs and user control.

Hong Kong’s technology ecosystem has been moving in the same direction. AI agents, local foundation models and governed automation have become more prominent in policy, research and enterprise discussions, with public and academic initiatives focusing on authorisation, traceability and risk controls. MonoClaw enters this environment as a commercial product for office users rather than a research platform, but its design mirrors the same debate over whether AI agents can be useful without creating new privacy and operational risks.

The launch also underscores a changing competitive field for productivity software. Major global platforms are embedding AI assistants into office suites, browsers, customer-service tools and enterprise resource systems. MonoClaw’s advantage, if it gains traction, will lie in its local deployment, Hong Kong-specific setup and promise of cost predictability. Its challenge will be proving that a local Mac-based assistant can match the reliability, integrations and performance of cloud-backed rivals while remaining simple enough for non-technical users.

Energy and infrastructure concerns add another layer to the product’s appeal. Cloud AI workloads have intensified scrutiny of data-centre electricity demand, cooling requirements and network dependence. MonoClaw argues that routine tasks such as inbox triage, drafting, reminders and meeting preparation can be handled on Apple Silicon at desk level, reducing reliance on remote inference for every interaction. The system can still use filtered cloud subprocesses for selected workloads, meaning its privacy and cost benefits will depend on how users configure and supervise each workflow.