VendorPM

vendorpm

There are two major ways to cooperate with a software or company: a dedicated team or a fixed-cost project. hardware development The suggests that your scope and project duration might change. Therefore, the total cost of the project will depend on the tasks you assign to the team, and you pay for the time engineers needed to accomplish these tasks. dedicated team model The means that you have all the requirements defined before starting the work, and you negotiate the total cost of, for instance, developing a product. fixed-cost project In this article we will explain when it’s more reasonable to go with a dedicated team model, how it might look, pros and cons, and how you can make this model more (and less) effective. Read also . Discovery Phase: One Small Step for You, One Giant Leap for Your Project Success How do you know if the dedicated team model will work for you? You might be a startup, an established business or a digital agency — it doesn’t make a difference; the dedicated team might work equally well for you. The first more important criterion is which you have. type of project A dedicated team is a right choice when you have a big project, several projects or a huge pool of tasks; when you don’t have a clear vision of future project deliverables; and when you know that many requirements will be revealed during the and . You know that the scope and timeline for this project might change, but the quality should stay on the same level. discovery phase R&D tasks The second benchmark for choosing a dedicated team is your . This type works when you have your own development team that you’re going to extend, you have an in-house project manager (PM) and you need an engineering team, you need a PM and a team, or you need an engineer with very specific expertise. staffing needs The third point is your . It’s very important not to be limited to a strict budget. budget There also might be a situation when you may consider switching . This makes sense when you have been working with a vendor for a certain period of time, so you know how the team works and estimates different tasks; the members have been shown to meet promised timelines; and you are satisfied with the quality level and trust your vendor. from a fixed-cost project to a dedicated team On the other side, this is not a one-size-fits-all model. The one of the following is true: you don’t trust your vendor, your budget is limited, or the project is small. It’s also not a good fit when your project plan is ready and very detailed, deadlines are defined, quality is a secondary priority for you, and you know that no changes to the scope might occur. dedicated team is not the right choice when How might your dedicated team look? Depending on how well you know the development process and what your staffing needs are, you might consider hiring only engineers or a team with a PM. When you hire only one or more engineers, you should clearly understand the development process, you are responsible for creating a task backlog, you will keep track of the work progress, and you should keep track of proper communication. When you hire a team with a PM, you might have significantly lower understanding of the development process, you will communicate only with the vendor’s PM, and the vendor’s PM will do all team management and keep track of the team lifecycle. What are the pros and cons of a dedicated team model? There will always be advantages and disadvantages no matter which cooperation model you choose. The dedicated team model offers you the highest flexibility for changes to planning and task priority, but, at the same time, you take responsibility for the communications and risks. The vendor also faces the pros and cons on its end, so you both always should negotiate to reach a win-win scenario. How to get the most and least effective collaboration So, when you’ve decided on a dedicated team, there are a few things that will help you be in this cooperation. more effective The first thing is your previous experience with dedicated teams or your understanding of the software development process. This will improve project management significantly. If your previous experience with software development was positive, this is a plus. The negative experience might cause a lack of trust in your vendor, leading to micromanagement and applying a process that helped fix issues last time, even if it’s not relevant. Second, especially when it’s a hardware project, you would benefit from having a highly skilled PM on your side, and you can predict the future impact of your engineering decisions (e.g., if you cut expenses now, you will end up with higher costs later). Other things impacting effectiveness are experience in interviewing tech staff, treating your dedicated team as your in-house team, visiting the dedicated team (preferably before starting the project), and motivating the team. Motivation influences performance a lot, and, with higher motivation, your team can do better than usual. So, here is what you can do to keep it at a high level: have a development process established, share a clear responsibility matrix, identify the goals, don’t use outdated technology stack, assign challenging engineering tasks, require very high-quality standards, swap staff responsibility from time to time to decrease instances of being “bored”. Read also . Guide on Managing Your Remote Product Development Team [Client’s Handbook] Some of your actions might also make your team , so we recommend avoiding the following tips. less effective Don’t work on tasks backlog. The team may often be unloaded and, after a certain time, become bored. Then, team members might ask to leave the project. Always rush deliveries. Teams will burn out quicker, especially if everybody understands that the rush has no purpose and always happens for no reason. Frequently introduce changes that completely cancel previous work. The team might treat new tasks as something that there is no reason to perform properly as they will be changed or removed anyway. Сommunicate with engineers unprofessionally, e.g. public conflicts, blaming, bullying. The team loses motivation, and any project-related activities are associated with something bad. Do not try to understand the development process. You should have a basic understanding of how the software is created; otherwise, the project management will become messy. Treat your dedicated and in-house teams differently. This might cause the customer’s in-house team not to feel accountable. Any issue might be recorded under the dedicated team. Summary The dedicated team is a really effective cooperation model and brings a lot of advantages, for example, you can select a team or apply any staff changes and be flexible with your project. However, prior to choosing this model, you’d better check whether the goals and needs of your project correspond. We recommend always aiming for a win-win situation with your vendor. This can be achieved when you have a professional PM, know the process, maintain a backlog, plan deliveries, and communicate properly and your vendor provides a strong team, proper expertise, and transparent reports. if you have some project idea in mind. Contact us

Is a Dedicated Team Model Right for You?

TypeScript’s increasing popularity in recent years has made it something many front-end developers have started to learn. As a front-end engineer, I was regularly told it was pretty simple and would be easy to just pick up, given my background in JavaScript. When I finally started working somewhere where we used TS, while it was true some of the basics were pretty easy to pick up, a lot of the features that make useful were not necessarily intuitive enough or used commonly enough to just pick up casually from working within a codebase. TypeScript Over the years, here are a few TypeScript features that I’ve learned that are really helpful in using TypeScript effectively. Discriminated unions - aka conditional sets of fields within types Sometimes, we have components that take in data that is very similar but not quite identical. In many cases, making a field optional works to resolve this. However, there are situations where either one or the other property is required, or if one property exists, a second property is required. For instance, if we have a button component that can either function as a link (which requires a path to navigate to) or a traditional button (which requires a function to pass to an onClick handler) - we don’t want to just make the path and onClickFunctions optional, because we need to have one or the other. Another example is an appointment object - some appointments might be single appointments, and some might be recurring. If it’s a recurring appointment, we need to include the recurrence interval. Discriminated unions allow us to have alternate sets of type parameters. If there are no shared fields, the simplest way to use discriminated unions looks like this: type RecurringAppointment={

  type: recurring

  recurrence_interval: 7  recurrence_unit: days}

type SingleAppointment={  type: single

}

type Appointment = RecurringAppointment | SingleAppointment; However, in many cases, there are going to be shared fields (like the appointment name and date) that make it easier to combine everything in one type of declaration, like so: type Appointment={

  name: string  date: string

}&(

{

  type: recurring

  recurrence_interval: 7  recurrence_unit: days

}|{

  type: single

}); This syntax doesn’t work with interfaces, which you may be using for their extension syntax (“extends”). In this use case, you use the following syntax: Instead of: interface Appointment extends AppointmentStylesProps Do this: type AppointmentProps = AppointmentStylesProps & {

   name: string    date: string

 } & (

     | {

   type: recurring

   recurrence_interval: 7    recurrence_unit: days

       }

     | {

   type: single

       }

   ); Cleaner null checks - Nullish coalescing operator Nullish coalescing operators are technically a JavaScript feature, but TypeScript added support for them with TS 3.7, and knowing how to use it can make certain type definitions a lot cleaner. Null checks - or checking that a variable has a value - are a regular part of writing code. However, it’s not always as simple a task as it seems like it should be - when using the boolean OR operator ( || ), any falsey values (0, ‘’, etc) are treated as falsey rather than as set values. let isUserActive = user.active || true // will always return true, even if we want it to return falselet divHeight = height || “Please enter a height”  //will not work if the height is 0

function convertToString(s: string | undefined): string {

 return s || ‘hello world’;

} //will change empty strings to ‘hello world’ even though they are already strings One alternative is to specifically check for undefined and null individually. Another is to check the typeof your variable, and if the type is correct, preserve the value. If you only have to do this once, these solutions aren’t so bad, but given how often null checks are required, it adds up, increasing the complexity of code, making the code more difficult to read, and increasing the likelihood something gets missed and bugs are introduced. let isUserActive = typeof user.active === “boolean” ? user.active : true;

let divHeight = typeof height === “number” || “Please enter a height”

function convertToString(s: string | undefined): string {

 return s === undefined ? ‘’ : ‘hello world’;

} Luckily, there is a built-in solution for this. The nullish coalescing operator, ??, is essentially a specialized version of || that treats both null and undefined (and nothing else) as false. This allows you to check if the variable has a defined value and respect the values of 0, ‘’, and false, instead of treating them as falsey and using the default value instead. let isUserActive = user.active ?? true; let divHeight = height ?? “Please enter a height”;

function convertToString(s: string | undefined): string {

 return s ?? ‘hello world’;

} Typing object properties Typing object keys {name: string, age: number} is one of the more accessible and common parts of typescript. However, it took some time in my professional career before I saw the typing of object property names. The syntax makes sense, but it is something I’m sure I never would have guessed without seeing it in use. This is the syntax for setting individual property types: `type User = {[userName: string]: string | undefined};` This is the syntax for checking a property type as a property of a specific object - ‘keyof T’ checks that that propertyName is a key within object T: function getProperty<T>(obj: T, propertyName: keyof T) {

  return obj[propertyName];

} This is the syntax for checking the property type of a specific object, written in a syntax different from the above example. This example checks that the key K exists as a key of object T (and then the function makes it optional). type Optional<T> = { [K in keyof T]?: T[K] }; Record<Keys,Type> - when you don’t know what the exact properties will be Sometimes, you have a general idea of what data you’ll be getting back from a back-end call but don’t know the specific properties you may be receiving. In instances like these, TypeScript’s Record type is very helpful. Record<Keys, Values> is an object type that takes a type for Keys, and a second type for values. For example:

Record<string,string> - {'a': 'b', ‘c’: ‘d’}Record<string, number> - {‘a’: 1, ‘b’: 2} Overload signatures - paired function parameter and return types Note: Arrow functions do not support overloading. You will have to change the syntax of an arrow function if you would like to use this feature Imagine you want to write a function that doubles a passed-in number. You also want this function to be able to double every number in an array of numbers. So the function accepts either a number or an array of numbers, and returns either a number or array of numbers.\ function double(x: number | number[]): number | number[] {

	If (typeof x === number){

		return x*2

} else {

x.map(n => n*2)

}

} In situations like this, we want to pair the return types with the parameter type - if we are passing in a number, we are returning a number, and if we pass in an array of numbers, we return an array of numbers, but we cannot return a number if we pass in an array of numbers or vice versa. We are able to pair the parameter and return types by using overload signatures. To do this, we declare function signatures separately from the full function definition. A function signature defines a function’s input parameters and types, as well as their return types. Here is an example using overload signatures (the first two lines are function signatures): function double(x:number):number;

function double(x: number[]): number[];

function double(x: number | number[]): number | number[] {

	if (typeof x === number){

	    return x*2

        } else {

            return x.map(n => n*2)

        }

} Default function parameter types Having a default parameter value for an optional parameter is a common part of development. For example, in this function, you can pass in two numbers to multiply together, but if the user only passes in one number, it will default to being multiplied by two: function multiply(a, b = 2) {

 	 return a * b;

}

TypeScript has a similar feature that allows you to set a default type for a parameter if a type is not set. For instance, we might have an online store, where we can usually count on data about prices to be numbers, but have some external calls or legacy code where prices are saved as strings. In this instance, we have our PriceArray set with a default type of number, but the ability to manually set an array to strings if necessary:\

type PriceArray<T=number> = Array<T>;

const CandyPrices: PriceArray = [2,5,9];

const VendorPrices: PriceArray<string> = [‘2’,’5’,’9’] Conditional return types based on options It’s possible a function we write may return something different depending on whether optional parameters are included or not. In these cases, we want to be able to set the correct return types if those optional parameters are included. For instance, imagine we are fetching a specific user’s data. We might want an option to retrieve only minimal user data and another option that allows us to include some user details, such as data to display for other users, such as their nickname and avatar. Rather than writing two separate functions, we can have an optional parameter of “displayData.” We can make two separate types - the plain User type and a UserWithDisplayData type, and use function overload signatures to set the return type based on the displayData option being set to true. IE: Interface User {

Id: string

Email: string

}

Interface UserWithDisplayData extends User {

	Nickname: string

	avatarUrl: string

}

Function fetchUser(id: number): User;

Function fetchUser(id: number, {options: {withDisplayData: true}): UserWithDisplayData;

function fetchUser(id: number, options: {withDisplayData?: false}): User | UserWithDisplayData {

 //call to fetch user info

} Given TypeScript’s popularity, it’s an essential skill for modern front-end developers to have. These features have helped me use TypeScript more effectively, spend less time trying to figure out how to even describe the issue I have to be able to search Google for documentation, and spend less time chasing down TS errors. Hopefully, some of these will be helpful to you!

7 Ways to Up Your TypeScript Game

Halloween. It’s spooky season, so let’s bludgeon a few old stack vendors to death — Appian, IBM, Salesforce, SAP, Pegasystems, IFS, Oracle, Software AG, TIBCO, UIPath…they’re The Walking Dead, and they know it. Back in 2010–2012 I wrote a fair bit about business process automation over on my old blog, BPM Redux, and something I was fascinated with was the concept of self-assembling or dynamic processes, created on the fly to handle a task using artificial intelligence without the need for drawing a process map or dicking around designing another set of screens. The problem I have with ‘business rules’ being an inherent part of some BPMS is that they start to constrain process decision making and flexibility, but having a set of AI routines that not only adapts on the fly (or JIT) but also learn and potentially create a brand new process instance out of evolving from previous instances… Fast forward to today and it might finally become a reality. I looked at what some of the larger stack and cloud vendors are doing today, and they all look so desperate — throwing Generative AI into their software stacks to appear relevant and forward-thinking. The trouble is, Gen-AI renders them pointless. Every. Single. One. Let’s take Pegasystems for example (disclosure: I used to work for them years ago). They have Generative AI as part of their software solutions now but it’s still rooted in the past, forcing enterprise users to not only continue using Pega but also to continually think about building workflows with it — it doesn’t matter that it’s “low-code” pseudo-development or that you can instantly draw new process steps using the magic of AI, you’re still stuck with using Pega. The same goes for all the rest — whether it be Salesforce, IFS, SAP; whether it’s ERP, CRM, RPA — what they all potentially understand and won’t tell customers is that you have all the data already, both structured and unstructured, and a Gen-AI layer is all you need on top. Think about the following example — a customer complaint. A customer emails in a complaint moaning about one of your products or services and expecting an action in response. Typically, the email will come from a contact form with all the required details to identify the customer or client, the product in question and what they expect done. If not, then it’s freeform unstructured data with a dollop of misery and anger. Normally, it falls into a defined process that an agent has been trained to perform, with clear steps already mapped out. If not, then it’s treated as an exception and passed to someone higher up the chain to make a decision on. All that takes time to create, and develop into someone’s expensive SaaS solution that looks like a dog’s dinner on the screen. Invariably, a few years later there will be a multi-million dollar “digital transformation” program sold by a consultancy deck to eke a few tweaks and savings out of this godforsaken process to justify the cost. But what if all this didn’t need to be done anymore? What if training a Large Language Model on your existing processes, rules, customer data, product or service information was all you needed to do? Going down this train of thought leads to a very different outcome. The LLM reads and understands the content of the email, pulling out key information like customer details, the product or service mentioned, and the specific issue being raised. In the case of a telephone conversation then we’ve already seen some Gen-AI solutions transcribe in real-time an interaction and then offer up advice, a response, or an answer to a question. So, already there is no need for parsing of data to another system to fill out a screen for an agent to look at. Based on this information, the LLM figures out the priority of the complaint, sees if the issue is common or recurring, and decides if any specific business rules or past actions apply. In some cases there may well be sentiment analysis done on the language of the complaint to determine just how important this is, how urgent or how annoyed the customer is. Things can get funky from here. Based on the type of complaint, the LLM creates a workflow to resolve the issue on the fly. This could involve updating customer data, processing a refund, or sending the complaint to a specialised team but it’s all done without a front end system we’ve all grown accustomed to loathe. With JIT (Just In Time) capabilities, the LLM can generate code on the spot to do necessary backend tasks. For example, if a refund is needed, the LLM creates the code to process it and updates the backend customer database with the details. Since the LLM has been trained on business rules, it makes sure all actions follow company policies — checking if the customer is eligible for a refund before processing it for example. The results of each complaint handling process are used to train the LLM further. If a complaint is resolved successfully, the LLM learns from the actions taken, improving future responses and workflows. Over time, the LLM can find recurring issues, improve existing workflows, and even suggest changes to business rules or policies based on patterns in customer complaints. The point here is that (a) you don’t need to define what the business process is any more than you do with task definition, nobody cares about static processes anymore when you can dynamically generate and execute them, (b) the LLM generates code and minimal screen UI to complete the task and have the agent involved but after that’s done the code and the UI is deleted, it’s an artefact that is no longer required because it was created to handle an interaction that is personal to that customer, and (c) humans are still in the loop, the efficiency gains are not in reducing headcount but removing the expensive excuse of paying for ancient software and unnecessary transformation programs based on old methods that are always initiated by some incoming c-suite with a relationship with a favourite vendor. It’s not as simplistic and current Gen-AI solutions aren’t geared up for this (yet) but this should be enough to start to question why you need a huge ERP implementation, or why an expensive CRM is required at all if you can just have a conversation with the customer data directly. Remember Master Data Management? Enterprises spent millions and years on making sure all their backend databases were fit for purpose, clean, deduped, they’re in potentially good shape and structured enough for a single Gen-AI layer on top and nothing else. Imagine not having to worry about integrating one behemoth frankenstack vendor to another, having to sync data sources, transform the data, orchestrate processes between them…it’s a pretty tantalising prospect and one that none of the aforementioned vendors really want you to know about. Major vendors offering Gen-AI wallpaper on top of the cracked and creaking software they push are slowly dying, the benefits they offer will eventually run dry when stacked up against using artificial intelligence as the alternative on its own. In a way Altman was right, it’s a new type of operating system, in this case it’s a business operating system and one that doesn’t need the bloatware. I’ve maybe sat on these ideas for too long now, I might go and start building again. I mean, depending on who you read the global workflow automation market size was valued at $16.41 billion in 2021 and is projected to reach $34.4 billion by 2030, growing at a CAGR of 9.71%. Not small numbers. Who’s with me? Halloween. It’s spooky season, so let’s bludgeon a few old stack vendors to death — Appian, IBM, Salesforce, SAP, Pegasystems, IFS, Oracle, Software AG, TIBCO, UIPath …they’re The Walking Dead, and they know it. Appian, IBM, Salesforce, SAP, Pegasystems, IFS, Oracle, Software AG, TIBCO, UIPath The Walking Dead, Back in 2010–2012 I wrote a fair bit about business process automation over on my old blog, BPM Redux , and something I was fascinated with was the concept of self-assembling or dynamic processes , created on the fly to handle a task using artificial intelligence without the need for drawing a process map or dicking around designing another set of screens. BPM Redux BPM Redux self-assembling or dynamic processes The problem I have with ‘business rules’ being an inherent part of some BPMS is that they start to constrain process decision making and flexibility, but having a set of AI routines that not only adapts on the fly (or JIT) but also learn and potentially create a brand new process instance out of evolving from previous instances… The problem I have with ‘business rules’ being an inherent part of some BPMS is that they start to constrain process decision making and flexibility, but having a set of AI routines that not only adapts on the fly (or JIT) but also learn and potentially create a brand new process instance out of evolving from previous instances… The problem I have with ‘business rules’ being an inherent part of some BPMS is that they start to constrain process decision making and flexibility, but having a set of AI routines that not only adapts on the fly (or JIT) but also learn and potentially create a brand new process instance out of evolving from previous instances… Fast forward to today and it might finally become a reality. Fast forward to today and it might finally become a reality. I looked at what some of the larger stack and cloud vendors are doing today, and they all look so desperate — throwing Generative AI into their software stacks to appear relevant and forward-thinking. The trouble is, Gen-AI renders them pointless. Every. Single. One. Every. Single. One. Let’s take Pegasystems for example (disclosure: I used to work for them years ago). They have Generative AI as part of their software solutions now but it’s still rooted in the past, forcing enterprise users to not only continue using Pega but also to continually think about building workflows with it — it doesn’t matter that it’s “low-code” pseudo-development or that you can instantly draw new process steps using the magic of AI, you’re still stuck with using Pega. Pegasystems Pegasystems The same goes for all the rest — whether it be Salesforce, IFS, SAP; whether it’s ERP, CRM, RPA — what they all potentially understand and won’t tell customers is that you have all the data already, both structured and unstructured, and a Gen-AI layer is all you need on top. you have all the data already, both structured and unstructured, and a Gen-AI layer is all you need on top. Think about the following example — a customer complaint. A customer emails in a complaint moaning about one of your products or services and expecting an action in response. Typically, the email will come from a contact form with all the required details to identify the customer or client, the product in question and what they expect done. If not, then it’s freeform unstructured data with a dollop of misery and anger. Normally, it falls into a defined process that an agent has been trained to perform, with clear steps already mapped out. If not, then it’s treated as an exception and passed to someone higher up the chain to make a decision on. All that takes time to create, and develop into someone’s expensive SaaS solution that looks like a dog’s dinner on the screen. Invariably, a few years later there will be a multi-million dollar “digital transformation” program sold by a consultancy deck to eke a few tweaks and savings out of this godforsaken process to justify the cost. But what if all this didn’t need to be done anymore? But what if all this didn’t need to be done anymore? What if training a Large Language Model on your existing processes, rules, customer data, product or service information was all you needed to do? Going down this train of thought leads to a very different outcome. The LLM reads and understands the content of the email, pulling out key information like customer details, the product or service mentioned, and the specific issue being raised. In the case of a telephone conversation then we’ve already seen some Gen-AI solutions transcribe in real-time an interaction and then offer up advice, a response, or an answer to a question. So, already there is no need for parsing of data to another system to fill out a screen for an agent to look at. Based on this information, the LLM figures out the priority of the complaint, sees if the issue is common or recurring, and decides if any specific business rules or past actions apply. In some cases there may well be sentiment analysis done on the language of the complaint to determine just how important this is, how urgent or how annoyed the customer is. Things can get funky from here. Things can get funky from here. Based on the type of complaint, the LLM creates a workflow to resolve the issue on the fly. This could involve updating customer data, processing a refund, or sending the complaint to a specialised team but it’s all done without a front end system we’ve all grown accustomed to loathe. With JIT (Just In Time) capabilities, the LLM can generate code on the spot to do necessary backend tasks. For example, if a refund is needed, the LLM creates the code to process it and updates the backend customer database with the details. Since the LLM has been trained on business rules, it makes sure all actions follow company policies — checking if the customer is eligible for a refund before processing it for example. The results of each complaint handling process are used to train the LLM further. If a complaint is resolved successfully, the LLM learns from the actions taken, improving future responses and workflows. Over time, the LLM can find recurring issues, improve existing workflows, and even suggest changes to business rules or policies based on patterns in customer complaints. The point here is that (a) you don’t need to define what the business process is any more than you do with task definition, nobody cares about static processes anymore when you can dynamically generate and execute them, (b) the LLM generates code and minimal screen UI to complete the task and have the agent involved but after that’s done the code and the UI is deleted, it’s an artefact that is no longer required because it was created to handle an interaction that is personal to that customer, and (c) humans are still in the loop, the efficiency gains are not in reducing headcount but removing the expensive excuse of paying for ancient software and unnecessary transformation programs based on old methods that are always initiated by some incoming c-suite with a relationship with a favourite vendor. (a) you don’t need to define what the business process is any more than you do with task definition, nobody cares about static processes anymore when you can dynamically generate and execute them, (b) the LLM generates code and minimal screen UI to complete the task and have the agent involved but after that’s done the code and the UI is deleted, it’s an artefact that is no longer required because it was created to handle an interaction that is personal to that customer, and (c) humans are still in the loop, the efficiency gains are not in reducing headcount but removing the expensive excuse of paying for ancient software and unnecessary transformation programs based on old methods It’s not as simplistic and current Gen-AI solutions aren’t geared up for this ( yet ) but this should be enough to start to question why you need a huge ERP implementation, or why an expensive CRM is required at all if you can just have a conversation with the customer data directly. yet Remember Master Data Management? Enterprises spent millions and years on making sure all their backend databases were fit for purpose, clean, deduped, they’re in potentially good shape and structured enough for a single Gen-AI layer on top and nothing else. Imagine not having to worry about integrating one behemoth frankenstack vendor to another, having to sync data sources, transform the data, orchestrate processes between them…it’s a pretty tantalising prospect and one that none of the aforementioned vendors really want you to know about. Imagine not having to worry about integrating one behemoth frankenstack vendor to another, having to sync data sources, transform the data, orchestrate processes between them…it’s a pretty tantalising prospect and one that none of the aforementioned vendors really want you to know about. Major vendors offering Gen-AI wallpaper on top of the cracked and creaking software they push are slowly dying, the benefits they offer will eventually run dry when stacked up against using artificial intelligence as the alternative on its own. In a way Altman was right, it’s a new type of operating system, in this case it’s a business operating system and one that doesn’t need the bloatware. In a way Altman was right, it’s a new type of operating system, in this case it’s a business operating system and one that doesn’t need the bloatware. I’ve maybe sat on these ideas for too long now, I might go and start building again. I mean, depending on who you read the global workflow automation market size was valued at $16.41 billion in 2021 and is projected to reach $34.4 billion by 2030, growing at a CAGR of 9.71%. Not small numbers. Who’s with me? Who’s with me?

Generative AI Will Kill Old Stack Vendors. Let It.

Cybersecurity threats are evolving at an alarming rate. From sophisticated malware to state-sponsored attacks, businesses worldwide face a battle as they attempt to safeguard their data. According to a report by Cybersecurity Ventures, the cost of cybercrime reached $8 trillion in 2023 alone and is projected to rise to $10.5 trillion by 2025. Businesses need robust security measures and future-proof strategies to prevent time consuming and costly security breaches. Unfortunately, attackers can exploit vulnerabilities from any point within a system. From the base hardware level to man-in-the-middle attacks and even social engineering, organisations still need a sufficiently intelligent threat prevention protocol. Security vendor bottlenecks leave them vulnerable to weaknesses. In these instances, businesses are over-reliant on a single solution or provider. Brander Group, a leading IT and network infrastructure consulting firm, tackles this issue with its vendor-neutral methodology. Offering a variety of network security & vulnerabilities solutions, Brander Group protects clients with multiple layers of redundancy so their network is avoids being at risk with a single point of failure. The Rising Tide of Network Security Threats In recent years, there has been a dramatic surge in sophisticated cyber attacks, with malware, ransomware, and advanced persistent threats (APTs) becoming increasingly prevalent. "The cybersecurity world has evolved at a dangerous pace," says Jake Brander, founder and CEO of Brander Group. "What worked yesterday may be obsolete today. That's why a flexible, vendor-neutral strategy is critical for long-term security." Vendor-Neutral Strategy: A Shield Against Vulnerabilities Brander Group specialises in vendor-neutral methods which are integral to protecting our clients. The company offers a diverse array of services & solutions, made possible by its partnerships with over 600 service providers globally. Brander Group provides each client with multiple options, fully managed deployments and support custom-tailored to their individual requirements and architectures. This strategy allows businesses to avoid the dangers of vendor lock-in, where dependence on a single provider can make it difficult to quickly adapt to new threats. Instead, Brander Group's clients benefit from a best-of-breed strategy, combining services from multiple providers to create a stronger security posture. "The idea isn’t just to avoid lock-ins. It's about creating a security ecosystem greater than the sum of its parts. We can mix and match solutions that are designed specifically for each client's needs," Brander explains. Brander Group's Expertise: The Human Element in Cybersecurity While the vendor-neutral strategy provides the framework, Brander Group's team of experts brings it to life. The company's provider-neutral engineers and consultants possess a deep understanding across a wide range of security protocols, allowing them to effectively and accurately wield each solution. "Technology is only as effective as the people implementing it. Moreover, the people implementing it must understand what is needed to effectively deliver each solution ." states Brander. Impenetrability Through Neutrality Brander Group’s services extend beyond simple security provision and implementation. Its team works closely with vendors and clients to develop comprehensive security strategies, conduct regular assessments, and provide ongoing support and training. With any system or device susceptible to several types of new age attacks, businesses worldwide are increasingly understanding the value of having a vendor-neutral network strategy. As Jake Brander aptly puts it, “There is no such thing as a truly secure system. But, with multiple layers of security, we can make it virtually impossible for any one security hole to be exploited. This is the true advantage of working with Brander Group – impenetrability through neutrality.” This piece was published as part of HackerNoon’s Business Blogging Program. For more details, please click here. Cybersecurity threats are evolving at an alarming rate. From sophisticated malware to state-sponsored attacks, businesses worldwide face a battle as they attempt to safeguard their data. According to a report by Cybersecurity Ventures, the cost of cybercrime reached $8 trillion in 2023 alone and is projected to rise to $10.5 trillion by 2025. Businesses need robust security measures and future-proof strategies to prevent time consuming and costly security breaches. Unfortunately, attackers can exploit vulnerabilities from any point within a system. From the base hardware level to man-in-the-middle attacks and even social engineering, organisations still need a sufficiently intelligent threat prevention protocol. Security vendor bottlenecks leave them vulnerable to weaknesses. In these instances, businesses are over-reliant on a single solution or provider. Brander Group, a leading IT and network infrastructure consulting firm, tackles this issue with its vendor-neutral methodology. Offering a variety of network security & vulnerabilities solutions, Brander Group protects clients with multiple layers of redundancy so their network is avoids being at risk with a single point of failure. network security The Rising Tide of Network Security Threats The Rising Tide of Network Security Threats In recent years, there has been a dramatic surge in sophisticated cyber attacks, with malware, ransomware, and advanced persistent threats (APTs) becoming increasingly prevalent. "The cybersecurity world has evolved at a dangerous pace," says Jake Brander, founder and CEO of Brander Group. "What worked yesterday may be obsolete today. That's why a flexible, vendor-neutral strategy is critical for long-term security." Vendor-Neutral Strategy: A Shield Against Vulnerabilities Vendor-Neutral Strategy: A Shield Against Vulnerabilities Brander Group specialises in vendor-neutral methods which are integral to protecting our clients. The company offers a diverse array of services & solutions, made possible by its partnerships with over 600 service providers globally. Brander Group provides each client with multiple options, fully managed deployments and support custom-tailored to their individual requirements and architectures. This strategy allows businesses to avoid the dangers of vendor lock-in, where dependence on a single provider can make it difficult to quickly adapt to new threats. Instead, Brander Group's clients benefit from a best-of-breed strategy, combining services from multiple providers to create a stronger security posture. " The idea isn’t just to avoid lock-ins. It's about creating a security ecosystem greater than the sum of its parts. We can mix and match solutions that are designed specifically for each client's needs ," Brander explains. The idea isn’t just to avoid lock-ins. It's about creating a security ecosystem greater than the sum of its parts. We can mix and match solutions that are designed specifically for each client's needs Brander Group's Expertise: The Human Element in Cybersecurity Brander Group's Expertise: The Human Element in Cybersecurity While the vendor-neutral strategy provides the framework, Brander Group's team of experts brings it to life. The company's provider-neutral engineers and consultants possess a deep understanding across a wide range of security protocols, allowing them to effectively and accurately wield each solution. " Technology is only as effective as the people implementing it. Moreover, the people implementing it must understand what is needed to effectively deliver each solution . " states Brander. Technology is only as effective as the people implementing it. Moreover, the people implementing it must understand what is needed to effectively deliver each solution . Impenetrability Through Neutrality Impenetrability Through Neutrality Brander Group’s services extend beyond simple security provision and implementation. Its team works closely with vendors and clients to develop comprehensive security strategies, conduct regular assessments, and provide ongoing support and training. With any system or device susceptible to several types of new age attacks, businesses worldwide are increasingly understanding the value of having a vendor-neutral network strategy. As Jake Brander aptly puts it, “ There is no such thing as a truly secure system. But, with multiple layers of security, we can make it virtually impossible for any one security hole to be exploited. This is the true advantage of working with Brander Group – impenetrability through neutrality. ” There is no such thing as a truly secure system. But, with multiple layers of security, we can make it virtually impossible for any one security hole to be exploited. This is the true advantage of working with Brander Group – impenetrability through neutrality. This piece was published as part of HackerNoon’s Business Blogging Program. For more details, please click here. This piece was published as part of HackerNoon’s Business Blogging Program. For more details, please click here. This piece was published as part of HackerNoon’s Business Blogging Program. For more details, please click here. This piece was published as part of HackerNoon’s Business Blogging Program. For more details, please click here . here

Brander Group's Vendor-Neutral Strategy Shields Clients from Network Security Vulnerabilities

Η στρατηγική ουδέτερης προμηθευτή του Ομίλου Brander προστατεύει τους πελάτες από ευπάθειες ασφάλειας δικτύου

La estrategia de Brander Group de no tener proveedores protege a los clientes de las vulnerabilidades de seguridad de la red

Brander Group-ի վաճառողի կողմից չեզոք ռազմավարությունը պաշտպանում է հաճախորդներին ցանցային անվտանգության խոցելիությունից

La strategia Vendor-Neutral di Brander Group protegge i clienti dalle vulnerabilità della sicurezza di rete

Brander Group のベンダー中立戦略により、クライアントをネットワーク セキュリティの脆弱性から保護

Brander Group-ის გამყიდველის ნეიტრალური სტრატეგია იცავს კლიენტებს ქსელის უსაფრთხოების დაუცველობისგან

ຍຸດທະສາດຜູ້ຂາຍ-ເປັນກາງຂອງກຸ່ມ Brander ປົກປ້ອງລູກຄ້າຈາກຊ່ອງໂຫວ່ຄວາມປອດໄພຂອງເຄືອຂ່າຍ

Стратегијата за неутрална добавувач на Brander Group ги штити клиентите од ранливости на мрежната безбедност

د برانډر ګروپ د پلورونکي - بې طرفه ستراتیژي پیرودونکي د شبکې امنیت زیانمننې څخه ساتي

Brander Grupo kaqpa Vendor-Neutral Estrategian Clientekunata Llika Seguridad Vulnerabilidades kaqmanta harkan

Брандер Гроуп-ова стратегија неутрална према добављачима штити клијенте од пропуста у мрежној безбедности

ናይ ብራንደር ግሩፕ ሸያጢ-ገለልተኛ ስትራተጂ ንዓማዊል ካብ ተቓላዕነት ድሕነት መርበብ ይከላኸለሎም

Since GDPR came into effect in 2018, the world has slowly shifted from perceiving cybersecurity as a mere burden that most organizations dismiss, to viewing it as a business vector that should be carefully analyzed, planned, monitored, and above all, receive managerial attention and dedicated resources. However, the shift from the first described “mode” to the second has been gradual, especially among organizations that did not have more than a slim handful of privacy regulations to which they were obligated to adhere. In such circumstances, this shift has been too slow and only mildly affected the managerial prioritization or the allocation of resources. While the awareness of organizations toward cybersecurity escalated dramatically, its practical application is still lagging. 2024 will leave significantly fewer organizations that could still claim to have this mere handful of regulations to follow. This will derive the urgency to quickly adapt, or otherwise, be at risk of breaches or be left outside of business opportunities due to cybersecurity implementation gaps. Continuing last year's trend of increased regulation frameworks, more regulations have been developed and published, depicting 2024 as another fruitful year in cyber and privacy guidance, with some notable themes and trends already taking shape:. 1. Regulatory Onslaught: AI and ESG Take Center Stage To say that the cyber and vendor security regulatory landscape is expanding is a mere understatement. For one, the is set to control and reduce AI-associated risks within the European region, underscoring a giant leap as it becomes the world’s first comprehensive AI law. EU AI Act Secondly, has increased public awareness of the frameworks due to increasing customers' support for environmental conservation, human rights, and ethical business operations. In the next few years, companies are more likely to prioritize building relationships with suppliers who align with their internal values. However, there is still no industry-wide standard for evaluating ESG performance, despite the greater attention being paid to ESG considerations. Third-Party Risk Management (TPRM) Environmental, Social, and Governance (ESG) Other regulatory frameworks surging include , which unifies guidance for all EU members, on response and recovery from all types of ICT-related disruptions and threats; which will improve the ability to incorporate trustworthiness considerations into the design, development, use, and evaluation of AI products, services, and systems; which puts forward guidelines for cybersecurity risk management, governance and incident reporting by public companies (US); which was designed to present tiered security levels for contractors for US Government vendors, and which has been drafted by the German Federal Ministry of Labor and Social Affairs (BMAS) to regulate Corporate Due Diligence Obligations in Supply Chains that are operating with connection to German entities. DORA (Digital Operational Resilience Act) NIST’s AI RMF (Risk Management Framework) SEC Disclosure Rules (by The Securities and Exchange Commission) CMMC (Cybersecurity Maturity Model Certification) The German Supply Chain Act (GSA) 2. Board Engagement: A New Paradigm for Cybersecurity and ESG As the importance of cybersecurity continues, supervising it will no longer be exclusive to designated teams. Moving forward, boards will be more involved, covering cybersecurity measures and broader ESG aspects. Today, the connection between cybersecurity and ESG is becoming more apparent, and board members now recognize that sustainable business practices require a comprehensive strategy. Boards must incorporate social responsibility, environmental impact, and transparency in governance into their cybersecurity plans as demand on corporations to do so grows. This all-encompassing strategy recognizes the wider influence of cybersecurity on the standing, reliability, and long-term viability of the company. Boards now have to consider the ramifications of this paradigm change for the organization's social effect, ethical standing, and compliance with changing regulatory frameworks, in addition to the technical nuances of cybersecurity. The inclusion of ESG and cybersecurity on the board's agenda indicates that organizational risk management has matured and is now in line with wider society's expectations for security procedures. 3. Generative AI: Stakes and Emerging Risks Generative AI increases productivity, automates documentation, and simplifies several procedures. Simply put, it is becoming a need for businesses to remain competitive as they incorporate it into their operations more and more. However, this integration has its own set of concerns, some of which have long existed but continuously remain as pressing issues. The autonomous generation of information, designs, and innovations by Generative AI systems raises concerns regarding intellectual property (IP). Protecting confidential data becomes crucial, necessitating the implementation of strong safeguards by enterprises to preserve their intellectual property. When massive volumes of sensitive data are processed by Generative AI systems, data integrity becomes even more important. As a result, ensuring the security and privacy of this data becomes an insurmountable task, requiring more extensive encryption, access controls, and monitoring systems. The risks associated with Generative AI aren’t brand new. However, the scale and complexity of AI-driven systems demand a more vigilant culture for organizations to proactively address these challenges. Through this, the full potential of Generative AI can be unlocked without compromising company data. 4. Persistent Threat: Data Breaches and Ecosystem Impact Make no mistake: data breaches will always be present despite advancements in cybersecurity. Even the biggest companies, frequently regarded as security heavyweights, haven’t gotten their immunity badge yet. As a result, repercussions impacting the whole ecosystem will likely continue as corporate activities are interdependent. We’ve seen some of the biggest data breaches last year alone. In March 2023, the ChatGPT breach led to the data exposure of . It contained the last four credit card digits, the expiration date, the email address, the payment address, and the first and last names of the current user. Other breaches that came months later include the MOVEit, JumpCloud, and T-Mobile, just to name a few. 1.2% of subscribers This pattern is unlikely to change in 2024 as threat actors evolve alongside the advancement of cybersecurity tools. The ongoing occurrence of data breaches emphasizes the necessity of continuous watchfulness, flexible security tactics, and industry-wide cooperation to strengthen the group's defense against cyberattacks. Establishing effective incident response and recovery procedures must take precedence over only preventing breaches for organizations. Just as important as preventing a breach in the first place is the capacity to quickly and efficiently lessen its effects. Nowadays, cybersecurity is a strategic necessity for preserving stakeholder confidence and protecting organizational resilience, not only a defensive tactic. 5. Rise of BISO: Bridging Business and Security A notable development in the organizational hierarchy is the rise of the This role serves as a bridge between business strategy and cybersecurity, acknowledging the intrinsic link between these two domains. The BISO is tasked with aligning security objectives with broader business goals, ensuring that cybersecurity measures contribute to, rather than hinder, organizational success. Business Information Security Officer (BISO). As vendor security becomes a core component of corporate strategy, the BISO is essential in helping the board, executive leadership, and the cybersecurity team communicate with each other. This integration ensures that organizational goals are smoothly integrated into security activities, rather than being isolated from the larger business strategy. The duties of the BISO go beyond technical proficiency to encompass a thorough comprehension of business operations, risk tolerance, and regulatory environment. Organizations can take proactive actions to address cybersecurity issues and leverage security measures as drivers of business resilience and innovation when they are strategically aligned. Conclusion The arrival of AI in cybersecurity represents a generational opportunity, one that must be approached with both vigilance and responsible stewardship. This era is unparalleled in its readiness to harness such a technological leap. Whether it is protecting against ongoing data breaches,, increased and active board participation, legal developments, or the rise of the BISO role, all these aspects can be supported, guided, and infrastructurally supported by Generative AI to ensure a more robust company posture to Vendor Security and TPRM as a whole. Indeed, TPRM has long been recognized as a formidable logistical challenge awaiting a solution within the technological domain. It is time we leverage the sophisticated technology at our disposal to address this challenge effectively, ushering in a new era of robust and resilient cybersecurity infrastructure.

The Future of Vendor Security: 5 Trends to Watch in 2024

Especially when talking about , many articles and videos focus on an architectural element that, in their opinion, is absolutely necessary for building such kinds of applications: . microservices API Gateways Yes, they are actually useful, but they are not the solution to every architectural problem. In this article, we will learn what API Gateways are, their pros and cons, why you should distinguish them from Load Balancers, and more. What is an API Gateway? Imagine that your application is made of several web services and APIs. Each of them will be deployed on a separate host, therefore having a different URL. While it can be helpful for internal development - you have a clear separation of operations available in your system - it can become cumbersome for the developers who have to integrate all those endpoints in their application. That’s where API Gateways come into play: they to uniform the access to your system. add a sort of in front of your set of APIs façade Say that you’ve built a Hotel booking system that is made of 3 services: , deployed at BookingAPI https://bookings.mycompany.org/api , deployed at SearchAPI https://mycompany.org/search/api , deployed at (notice the ) DiscountAPI https://discounts.mycompany.org/v1/api v1 By adding an API Gateway, you can hide these APIs behind a single host, like , mapping the route path to the original services’ URLs. https://api.mycompany.org/ As with everything in the world, there are advantages and disadvantages. Let’s learn! 🔥 Advantages of an API Gateway API Gateways have lots of advantages. It’s not a coincidence that they are being used in many architectures. Let’s see some of the best characteristics of an API Gateway. Internal API security Since your internal APIs are hidden behind an API Gateway, you make them discoverable by intruders who might want to access your systems and data. less Let’s go back to the Hotel Booking system in our example. External users will only see the host without knowing the structure of the internal API services. This . api.mycompany.com reduces the attack surface You can also by adding them to the API Gateway and have them applied to all the APIs behind the Gateway. centralize Access Control Policies Finally, you can and analyze the traffic to spot unusual behavior in a single place. monitor all the incoming requests Reduced complexity Some concerns are common to all the APIs within the same system, such as , , and . rate limiting throttling access control With API Gateways, you can for such common concerns in a single point. For example, once you have defined some rate limiting policies on your Gateway, you can have the same settings automatically applied to every internal API endpoint (well, not “physically” applied to the internal APIs, but since the Gateway blocks some incoming requests, they will not reach the internal systems as well). centralize the settings API Gateways also help with : since you have all the internal services listed in the API Gateway, just by looking at its configurations, you can see the list of the deployed APIs and their hostname. service documentation Flexibility Since API Gateways act as a façade in front of other services, you can integrate services that work with . different protocols or formats For example, you can have one service that exposes GraphQL APIs, another one that works with GRPC, and have them all exposed as REST APIs using the API Gateway as a wrapper/converter to and from such formats. Hiding the actual API endpoints behind a Gateway also allows you to , which is a technique that will enable you to aggregate the results from different internal API calls and return the caller only the final result (as opposed as making the client call each single service and compose the result afterwards). implement API Composition Enhanced performance Depending on the vendor, you can have different tools to improve the overall performance. For example, you can to get quicker response times, or you can apply uniformed . cache responses data compressions Some vendors allow you to have multiple instances of the same service available behind the API Gateway, acting as a sort of Load Balancer. Another powerful technique you can implement is . In a simple architecture, if you have to communicate securely with three systems to aggregate the result, you have to validate the SSL connection three times. With , you can move these operations on the API Gateway component and avoid doing that in all the other services, making the application more performant. SSL Termination SSL Termination Disadvantages Single point of failure Since we placed an API Gateway in front of all the other API applications, all the external communication passes through the API Gateway. This means that , even though the single APIs are still up and running. if the API Gateway is unavailable, the whole system becomes unavailable as well So, when using an API Gateway: : an error in the configurations can have consequences on the whole system; Beware of the settings Ensure that the Gateway is capable of handling the incoming load of requests: if the API Gateway cannot cope with the number of incoming requests, it may become unavailable and make the whole system offline. Ensure that you have some (see the previous point). protection against DDoS attacks Increased latency An API Gateway is an in the API processing: when a client wants to call an API application, all requests must first pass through the API Gateway, which, in turn, will call the internal API. additional hop This processing, this routing, adds some network latency. Maybe it’s not noticeable, but it depends on the Gateway you choose, the underlying infrastructure, and the processing done by the Gateway. Vendor Lock-in Once you have deployed and configured an API Gateway, moving to another vendor might be difficult. You risk vendor lock-in, with all the consequences: if the price goes up or if they remove some functionalities that you need, you will have to come up with a solution to migrate that specific part of your infrastructure to another vendor. It might not be so easy - some straightforward ways to mitigate the risk are to and to that validate the routing and the functionalities. make your systems platform agnostic create e2e tests API Gateway VS Load Balancer Some people I know and the authors of some articles I read use API Gateway and Load Balancer as synonyms. Let me get it straight: they are not the same! Yes, they both are components that work with incoming requests. But they serve two totally different purposes. While Load Balancers “just” spread incoming requests across multiple instances of the same service, API Gateways act as a façade in front of different types of services. They are two totally different components of an architecture. Some vendors provide both functionalities, while others don’t. So, keep the two meanings distinct, and try to use the correct wording. API Gateway vendors comparison Here is a list of some API Gateway vendors’ prices, pros, and cons. Notice: . The info in this list comes primarily from their official documentation and, in some cases, from other resources that compare such products. I have yet to try all these vendors : it’s an Open Source product that provides features such as authentication, rate limiting, logging, caching, and more. It is written in Lua and runs on top of Nginx. Kong Price: Kong offers free community and paid enterprise editions. Pros: Kong is easy to install and configure, supports many plugins and integrations, and has a large and active community. Cons: Kong may have performance issues when handling large volumes of traffic, requires Nginx as a dependency, and has limited support for GraphQL, which is available only for the enterprise edition. : it’s a lightweight API Gateway written in Go. It offers API analytics, a developer portal, a dashboard, security, and other features. It can be deployed on-premises, in the cloud, or as a hybrid. Tyk Price: Tyk offers a 5-week free trial and four payment tiers. The Starter edition costs $600 per month for up to 10 million API calls. Pros: Tyk is fast, scalable, and flexible and has a rich set of features and plugins. Cons: Even though Tyk is open source, it has no free tier. : an API Gateway that is based on Express.js. It provides a single package with dynamic routing, access control, and API management. It is written in JavaScript. Express Gateway Price: Express Gateway is free and open source. Pros: Express Gateway is simple to use and customize, supports the Node.js ecosystem and middleware, and can be easily extended with plugins. Cons: Express Gateway may not be suitable for complex scenarios, as it lacks some advanced features such as caching (which is in the Medium Term roadmap). : an open-source API Gateway that is part of the Netflix OSS stack. It provides dynamic routing, resiliency, security, and monitoring for microservices. It is written in Java and can be integrated with other Netflix components. Zuul Price: Zuul is free and open source. Pros: Zuul is robust, reliable, and battle-tested by Netflix and supports filters for request processing. Cons: Zuul has limited documentation. : it offers features such as a developer portal, Gateway, policies, throttling, caching, and more. Azure API Management Price: Azure API Management offers a free tier and several paid tiers. The paid tiers start from $0.07 per hour for the Developer tier and go up to $3.83 per hour for the Premium tier. Pros: Azure API Management is easy to integrate with other Azure services, supports multiple protocols and formats, and has a rich set of features and policies. Cons: Azure API Management may have a complex pricing model, and it requires Azure Active Directory for authentication. : It provides complete lifecycle API management, from design and development to security and analytics. Amazon API Gateway Price: Amazon API Gateway offers a free tier and a pay-as-you-go model. The pay-as-you-go model charges per million API calls received, plus data transfer and caching fees. Pros: Amazon API Gateway is scalable, reliable, and secure; it supports serverless architectures and WebSocket APIs. Cons: Amazon API Gateway may have a steep learning curve for beginners, requires AWS Lambda for custom logic, and has limited documentation and support. It has a complex pricing tier. : It supports OpenAPI Specification v2 and gRPC APIs. Google Cloud API Gateway Price: Google Cloud API Gateway offers tiers based on the number of API calls. From 0 to 2 million calls, the service is free. From 2 million to 1 billion calls, you pay $3.00 per million API calls, while from 1 billion on, you pay $1.5 per million API calls. Pros: Google Cloud API Gateway is easy to use and deploy, supports multiple authentication methods and protocols, and integrates well with other Google Cloud services. Cons: It has limited plugins and integrations. Further readings It’s not the first time we talked about API Gateways in this blog: in fact, there’s an old article where I shared some things I learned about API Gateways the first time I heard about them: 🔗 API Gateways - an overview | Code4IT We also learned how to use Azure API Management to integrate the API Gateways product provided by Azure to organize some .NET APIs. 🔗 How to create an API Gateway using Azure API Management | Code4IT This article taught us that API Gateways are different from Load Balancers. Do you know what are some types of Load Balancers and why you should care? 🔗 Davide’s Code and Architecture Notes - L4 vs L7 Load Balancer | Code4IT Wrapping up Beware those who say that API Gateways are «the best thing to add to a microservice architecture»! As we learned, there are some downsides, too. Always make sure that the products and the components you choose fit your necessities and that you learn when something is for you. not I hope you enjoyed this article! Let’s keep in touch on or ! 🤜🤛 Twitter LinkedIn Happy coding! 🐧 Also published . here

A Guide to API Gateways: Unveiling Advantages, Disadvantages, and Vendor Comparisons

In the realm of , where Platform as a Service (PaaS) offers convenience, a subtler challenge lurks beneath the surface— . Imagine it as a digital labyrinth, where once you step in, finding the exit becomes intricate. Vendor lock-in refers to the situation where adopting specific PaaS services shackles you to a single provider, limiting your agility and freedom to choose. cloud computing Vendor Lock-in This brief journey of an article explores the essence of and unveils the strategies that can illuminate the path to liberation. As we navigate through this technological maze, understanding how to untangle ourselves becomes paramount. vendor lock-in concerns within the PaaS landscape Vendor Lock-in Concerns in PaaS When using PaaS, you often rely on tools and services unique to the provider. These offerings might be tailor-made to fit their platform, simplifying your work initially. But, as your application grows, this reliance can lead to complications. Imagine building a complex puzzle using pieces from a single set. If you want to switch providers, those puzzle pieces might not fit the new set, causing integration headaches and functionality losses. Data is the backbone of modern applications, and handle it in their own distinct ways. They might use specific data storage methods and formats, which makes moving your data to another platform tricky. It's like translating a book written in one language to another – nuances can be lost in translation. This lack of data portability might tie your application to a single provider, limiting your flexibility and freedom to choose. PaaS providers Integrating PaaS services with your existing systems can be as intricate as fitting a jigsaw puzzle with pieces of a different design. Each PaaS provider offers unique integration methods, making it challenging to switch between them. When considering a new provider, you'd not only need to learn their integration techniques but also grapple with the complexities of migrating existing integrations. This can cause delays, disruptions, and unforeseen costs. Mitigation Strategies for Vendor Lock-in When engaging with PaaS, the importance of cannot be overstated. These APIs serve as the universal language between your application and the PaaS platform. Opting for standardized APIs lessens your reliance on vendor-specific jargon. This simple step significantly lowers the risk of being trapped within a single provider's dominion. standardized APIs Imagine containers as digital parcels. These containers think Docker and Kubernetes, encapsulate your application, along with its dependencies and configurations. They bestow a kind of mobility to your application, enabling it to journey across diverse PaaS environments with remarkable ease. Containerization sets your application free, removing the fear of being ensnared in a solitary platform. In the pursuit of PaaS autonomy, the mantra is "loose coupling." means breaking down your application into distinct, independent components. This approach infuses your application with adaptability. Should you wish to switch out a specific PaaS service, the loosely connected nature of your modules cushions against disruptions. Upgrading or changing services becomes less of a storm and more of a breeze. Modular architecture To evade the clutches of vendor lock-in, consider the multi-cloud strategy. By distributing your application across multiple PaaS providers, you effectively distribute your risk. Different providers offer varied strengths, and harnessing these diversities creates a resilient safety net. In adopting a multi-cloud approach, your applications thrive with heightened flexibility, and the specter of total lock-in recedes. Wrapping up In the world of , where convenience meets complexity, the specter of vendor lock-in looms. Our journey through the landscape of vendor lock-in concerns has illuminated the risks of dependency on proprietary technologies, the challenges of data portability, and the intricacies of integration. PaaS However, fear not, for the beacon of mitigation strategies shines bright. By embracing standardized APIs, harnessing the power of containerization, fostering modular architectures, and embracing a multi-cloud mindset, we pave the way to liberation from the shackles of lock-in. As we navigate this path, let us remember the wisdom of balance. Convenience in the present must not eclipse the imperative of long-term flexibility. So, choose wisely, dear pioneers of PaaS. Strive for innovation without compromise, for in the art of balancing lies the power to thrive in a world of endless possibilities.

Vendor Lock-In in PaaS: Identifying Risks and Implementing Mitigation Strategies

FTC v. Amazon Court Filing, retrieved on Sep 26, 2023, is part of . You can jump to any part in this filing . This is part 22 of 80. HackerNoon’s Legal PDF Series here b. Online marketplace services are not reasonably interchangeable with selling as a vendor 191. Selling products as a vendor to a retail store, whether online or offline, who then sells to shoppers is not reasonably interchangeable with buying online marketplace services. 192. Selling products as a vendor to a retailer involves a pricing and transaction structure different from buying online marketplace services. A vendor generally sells goods to a retailer for a wholesale price. The retailer takes legal title to the goods and can sell them to shoppers. Online marketplace services providers price their services differently, typically including a percentage-based commission fee. The seller retains legal title to the goods and sells those goods directly to shoppers on the online marketplace. 193. A vendor typically sells goods in batches to retailers, such as in a wholesale relationship. A seller operating through an online marketplace, by contrast, typically sells goods one at a time to online shoppers. 194. Vendor arrangements also exhibit different features and characteristics from online marketplace services. A vendor usually gives up the ability to set the price offered to shoppers, and the retailer typically sets the shopper-facing prices. But sellers who buy online marketplace services retain the ability to set and adjust prices to shoppers. Many merchants prefer purchasing online marketplace services to vending to a retailer so that they can retain the ability to set their own prices to final customers. 195. Selling as a vendor often requires the vendor to give physical control of its goods to the retailer. That reduces the vendor’s ability to decide which goods to offer and when to make goods available. Unlike the retailer model, an online marketplace services provider allows sellers to maintain control over which of its goods will be offered at what times. 196. Selling as a vendor also limits the seller’s access to retail sales data, which is usually controlled by the retailer. Some providers of online marketplace services, including Amazon, provide customer-level sales and shopping data to sellers but not vendors. 197. Industry participants recognize that these are important distinguishing characteristics. For example, Walmart tells sellers that using its marketplace allows them to “[r]emain in control of your business.” Continue Reading . Here About HackerNoon Legal PDF Series: We bring you the most important technical and insightful public domain court case filings. This court case 2:23-cv-01495 retrieved on October 2, 2023, from is part of the public domain. The court-created documents are works of the federal government, and under copyright law, are automatically placed in the public domain and may be shared without legal restriction. ftc.gov

Distinguishing Online Marketplaces from Vendor Selling: A Game of Control and Pricing

Making all team members directly accountable to you through modern platforms means fewer surprises. Most marketing, public relations and sales agencies will tell you with pride that you will have a single point of contact who will own their relationship with you. You will barely see the other folks working for you. It’s also true in other industries from fund administration in private capital to IT implementation. The problem with this model is that your single point of contact might be the only person at the service provider who knows your business. This situation is why private capital CFOs for instance keep their fund administrators after they’ve invested significant time in a long-running relationship. It’s also why they switch fund administrators when there is too much churn at their service provider’s firm. The same thing happens in marketing and public relations, but let’s stick with the fund services model for the moment. We’ve seen the future in that particular space. Who’s in charge here? Should you really need a designated advocate and single “throat to choke” to get the rest of your partner’s team to understand your needs? Talking to leaders in the fund services industry has caused us to ask whether a “single contact” is a cover for the fact that everyone else touching your operations is a specialist who is shuffled in and out to perform work without deeply understanding how your business works. Leading teams are built around a more robust model where you have a more complete and visible team helping you out, that sees and knows what you are trying to achieve. It’s something that’s caused us to reflect on our own business, including in the past two weeks when the two primary leaders of our outfit were off the grid. Have we done a good job of ensuring we have a deep bench that’s well versed in our clients’ work and how to best support them? Every person, a point person Does your partner ensure all team members can serve you directly along with the team lead. I don’t want to overstate that point. Different members of your partner’s team have different levels of experience and unique specialties. Going back to fund administrators, these firms often err on the side of a single point of contact where knowledge of your needs and style are consolidated. But more sophisticated firms are now erring on the side of the full team being allowed to focus on your needs on a sustained basis. Every member of your outsourced team becomes immersed in what makes you unique in the private capital ecosystem. They develop well-rounded private equity professionals versus specialized fund administrators. The result is that every member of the team serving you is known to you, and fluent in your firm’s culture, process, and aims. That approach often surprises clients. It frankly feels like a truly in-house team (I know, this rhetoric is over played… but when it really happens you know it). Here’s where tech can come in. The Amazon approach to fund services (and professional services) In this system, if it’s supported by the right tech, team members handle client inquiries in near real-time, through chat — coordinating the full team to eliminate fragmented responsibilities and multiple meetings and emails. That also means being built to allow for small teams that focus on smaller sets of clients. (Amazon has shown how this approach scales with Jeff Bezos’ “ .” We should be able to feed your team with two pizzas. That’s the right size to be cohesive, collaborative, and aligned with your team.) Two-Pizza Teams This is fueled with data securely available to all team members so they have up-to-date knowledge of who has talked to the client, when they spoke, what the client’s latest questions or directions were, and how they or others can help the process. Client teams are well-informed, don’t encounter duplicative questions, and don’t wonder where outstanding work stands. Lastly, you expand the efficiency of each outsourced team member and the intelligence of their work with data operations and automation. When you’ve done this, you’ve reduced friction significantly. This approach also means you’re able to move from peaks and valleys of activity to streaming work that is more agile than any legacy approach. We expect others will attempt to copy this strategy, and we encourage them to do so.

Do You Know Everyone on Your Vendor’s Team?

আপনি কি আপনার বিক্রেতার দলের সবাইকে চেনেন?

Kennen Sie jeden im Team Ihres Lieferanten?

¿Conoce a todos los miembros del equipo de su proveedor?

Connaissez-vous tous les membres de l'équipe de votre fournisseur ?

क्या आप अपने विक्रेता की टीम के सभी लोगों को जानते हैं?

ベンダーのチームの全員を知っていますか?

공급업체 팀의 모든 구성원을 알고 계십니까?

Você conhece todos na equipe do seu fornecedor?

Tedarikçinizin Ekibindeki Herkesi Tanıyor musunuz?

Bạn có biết mọi người trong nhóm của nhà cung cấp của bạn không?

您认识供应商团队中的每个人吗？

In today's digital age, cybersecurity is a top concern for organizations of all sizes. As cyber threats continue to evolve and become more sophisticated, it's crucial for companies to have access to the latest and most effective cybersecurity solutions. However, finding the right vendor to meet their specific needs can be a daunting task for Chief Information Security Officers (CISOs) or Chief Information Officers (CIOs). Similarly, many cybersecurity solutions providers find it difficult to find the right buyer for their services. This article will discuss the difficulties faced by chief information security officers and vendors in the cybersecurity industry when conducting business and how is making the process more efficient. Execweb Challenges It's time we delve deep into the challenges of the cybersecurity vendor-client pairing process, to emphasize that both CISOs and cybersecurity vendors face unique obstacles. CISOs struggle to sift through the crowded marketplace and find the best solution for their organization, while vendors face difficulty in reaching the right buyers for their services. In the following sections, we have listed and explained the challenges faced by both players; A CISO's Perspective With so many vendors offering similar solutions, it can be difficult for CISOs to determine which one is the best fit for their organization. 1. Sifting through a crowded marketplace: Many vendors do not provide enough information about their solutions, making it hard for CISOs to evaluate and compare them. 2. Limited information: Traditional processes can be time-consuming and resource-intensive, requiring multiple rounds of meetings, demos, and negotiations. 3. Time-consuming: It can be challenging for CISOs to evaluate a vendor's capabilities and ensure they have the necessary expertise to meet their organization's specific needs. 4. Difficulty in assessing vendor capabilities: Even if a vendor has a great solution, it may not be the right fit for the organization's specific needs. 5. The mismatch between solution and organization's needs: CISOs may not have access to the and best practices, making it harder for them to make informed decisions about which solutions to implement. 6. Limited access to industry insights: latest information on cybersecurity trends A Cybersecurity Vendor's Viewpoint There are several challenges that cybersecurity vendors may face when looking for a buyer for their cybersecurity solutions. These can include: Finding the right buyers for cybersecurity solutions can be a difficult task, as many organizations may not be aware that they need a certain type of solution or may not have the budget for it. 1. Difficulty in identifying potential customers: Some buyers may be hesitant to trust new vendors or solutions, especially if the vendor is a start-up or a small business. 2. Lack of trust from potential customers: Cybersecurity solutions can be complex and difficult to understand for non-technical buyers, making it challenging for vendors to effectively communicate the value of their solution. 3. Difficulty in communicating the value of the solution: The cybersecurity market is highly competitive, and vendors may find it difficult to differentiate their solutions from those of their competitors. 4. Difficulty in differentiating from competitors: Many organizations may resist implementing new cybersecurity solutions, as they may require changes to existing processes and systems. 5. Resistance to change: Many organizations want to see a clear return on investment (ROI) before making a purchase, and it can be difficult for vendors to demonstrate the potential ROI of their solutions. 6. Demonstrating ROI: Many organizations are required to comply with various regulations and standards, and vendors may find it difficult to ensure that their solutions meet these requirements. 7. Meeting compliance requirements: Cybersecurity solutions can require a lot of research and evaluation, which can lead to a long sales cycle for vendors. 8. Long sales cycle: Fixing the broken collaboration between security practitioners and cybersecurity vendors Execweb was founded 2 years ago with the mission to provide an online CISO executive network to bridge the gap between the industry’s top cybersecurity services providers and c-suite executives. As the CEO of Execweb, says; Val Tsanev Execweb solves these challenges by providing a platform that connects the right vendors with the right customers. By providing a platform for connecting and engaging, we're making it easier for organizations to find the right cybersecurity solutions and for vendors to find their ideal customers. What does Execweb Offer? Execweb's platform streamlines the process of connecting CISOs and cybersecurity vendors, reducing the time and resources required to find the right match. 1. Increased efficiency: Execweb's platform provides detailed information about vendors' solutions and capabilities, making it easier for CISOs to evaluate and compare different options. All the vendors registered on our platform are first assessed for quality based on their past projects, human resource, and success stories. 2. Greater transparency: Execweb provides CISOs with access to the latest information on cybersecurity trends and best practices, helping them make informed decisions about which solutions to implement. 3. Access to industry insights: Execweb's platform uses advanced algorithms to match CISOs with vendors that can meet their specific needs, reducing the risk of mismatches. 4. Tailored matchmaking: Execweb's platform allows CISOs and vendors to book virtual meetings, reducing the need for in-person meetings and travel. 5. Virtual meetings: Execweb platform also offers roundtable discussions for CISOs and vendors to share their experiences and learn from each other. 6. Roundtable discussion: Our platform is cost-effective for both CISOs and vendors, as it eliminates the need for expensive marketing campaigns and sales efforts. All you need to do is sign up on the platform and choose the people you want to work with. 7. Cost-effective: Execweb platform provides an opportunity for CISOs and vendors to build a network and expand their professional circle. 8. Networking opportunity: The Next Step If you're a CISO or CIO looking for the right cybersecurity vendor, or a vendor looking to connect with potential customers, we invite you to on our platform today and get your cybersecurity needs met. By joining Execweb, you'll be part of a community of professionals who are dedicated to enhancing the cybersecurity ecosystem through better communication and understanding. register Conclusion By revolutionizing the way CISOs and cybersecurity vendors do business, we make it easier for organizations to find the right solutions and for vendors to find their ideal customers. Join us on our mission to enhance the cybersecurity ecosystem by registering on our platform today.

Revolutionizing the Way CISOs and Cybersecurity Vendors Do Business

Revolucionando la forma en que los CISO y los proveedores de ciberseguridad hacen negocios

Révolutionner la façon dont les RSSI et les fournisseurs de cybersécurité font des affaires

सीआईएसओ और साइबर सुरक्षा विक्रेताओं के व्यवसाय करने के तरीके में क्रांति लाना

CISO とサイバーセキュリティ ベンダーのビジネスのやり方に革命を起こす

Revolucionando a maneira como os CISOs e os fornecedores de segurança cibernética fazem negócios

Cách mạng hóa cách thức kinh doanh của các CISO và nhà cung cấp bảo mật mạng

彻底改变 CISO 和网络安全供应商开展业务的方式

Stories, News & Mentions about VENDORPM

Vendorpm’s Stories on HackerNoon