Platforms & Architecture
Insights seen through platforms & architecture, across every sector.
46 articles · Platforms & Architecture · page 1 of 3
Articles
Week of 19 October 2026
A lost zone is the failure banks plan for. Google’s London outage tested five layers of that plan
A power failure took down one zone of Google Cloud’s London region on 20 October 2026, the loss multi-zone banking systems are built to absorb. Services stalled anyway. Surviving a lost zone depends on five layers, and each has to be tested.
Week of 10 August 2026
Post-quantum signatures are still being chosen, so build PKI to switch twice
Digital signatures had moved up the post-quantum to-do list, yet two years after NIST’s first standards the choice of signature scheme was still open. Sort signatures by how long they must stay trustworthy, and design each group to change twice.
Week of 15 June 2026
The client-certificate deadline that moved, and the certificate authorities that didn’t wait
Chrome pushed back its deadline for using public web certificates to prove a client’s identity, to March 2027. Certificate authorities kept their own, earlier schedules. For any system-to-system link that relies on one, the real deadline belongs to whoever issues the certificate.
Week of 11 May 2026
Payer prior authorization APIs will only help the providers ready to call them
By January 2027, federal rules require health insurers to offer electronic doorways for prior authorization. Only health systems that have settled three things first will benefit: which system knocks on the door, whether the chart can answer, and who owns the request.
Week of 13 April 2026
Direct File’s quiet exit made retirement part of service design
The first tax deadline without IRS Direct File showed that switching off a public digital service is a piece of design work in its own right, with duties to returning users, to the states that connected to it, and to the public record.
Week of 16 March 2026
States could build Medicaid work requirements from the statute before the rule arrived
By spring 2026, states had nine months to put Medicaid work requirements into practice and no federal rule yet. The safe path: build what the law already fixed, make adjustable what the rule would decide, and lock in delivery capacity before it ran out.
Week of 15 December 2025
Crypto trust charters and community banks: the binding decision sits in the core
The OCC’s conditional approval of five crypto trust banks gave smaller banks and credit unions credible custody partners. The harder problem drew less notice: how any of it would show up in the ledger, statements and reports their core systems produce.
Week of 20 October 2025
One region failed, many financial apps stalled: concentration risk sat in the dependencies
One Amazon Web Services region in Virginia faltered in October 2025, and financial apps that looked resilient on paper stalled anyway. The weak points were shared services and slow recoveries, so the answer is mapping dependencies and rehearsing degraded service, not reflexive multi-cloud.
Week of 13 October 2025
Why Windows 10’s end of support split every hospital fleet in three
Windows 10 support ended and hospital computers split into three groups: those IT controls, those medical device makers control and those nobody clearly controls. Reporting them as one migration hid where the real risk sat, and only the first group had a simple answer.
Week of 8 September 2025
Why bank change control never saw the npm hijack
In September 2025, poisoned versions of widely used open-source code were live for about two hours. Bank change control was built to approve the code people write. This attack came in through code the build process fetched by itself, which nobody approves.
Week of 25 August 2025
OAuth integrations make their vendors custodians of your credentials
The Salesloft Drift data theft began inside a vendor, not inside any customer’s Salesforce. Approving an integration hands that vendor a standing key to your data, and most vendor reviews never asked how the key was kept.
Week of 21 July 2025
ToolShell made patching the easy part of a SharePoint emergency
Attackers exploiting on-premises SharePoint in July 2025 stole the keys that let them come back after the patch. For agencies running collaboration servers in-house, the response became three jobs with different owners: patch, evict, and decide whether the server should exist at all.
Week of 9 June 2025
Google Cloud’s June outage moved bank cloud diligence from uptime to change safety
Google Cloud’s June 2025 outage began with a routine policy update that reached every region at once. For banks, asking how a provider releases code and settings reveals far more than its promised uptime figure.
Week of 5 May 2025
Why the air traffic control rebuild started with the wires
The Newark outages that preceded Washington’s May 2025 air traffic control plan broke in the links between buildings, not in the radar screens. For agencies modernizing systems that cannot stop, the wires, the switchover and the people deserve as much planning as the software.
Week of 14 April 2025
How the CVE contract scare exposed the public plumbing under every patching policy
For one day in April 2025, the program that gives every software flaw its name looked set to switch off. The scare showed that patching policies and audit evidence rest on three public layers, each with its own way of failing.
Week of 27 January 2025
DeepSeek arrived in three forms in one week, and each needed a different control
Within days, the same DeepSeek model reached organizations as a phone app, a developer service and freely downloadable files running on U.S. clouds. Blanket bans treated them as one risk. They were three, each owned by a different team.
Week of 21 October 2024
Final and already in court: sorting open banking work by how much you would regret it
The CFPB’s open banking rule was final and in court on the same day. Banks could neither wait out the lawsuit nor build blindly, so the smart move was sorting the work by how much each piece would be regretted if the rule fell.
Week of 12 August 2024
Post-quantum priority starts in the records retention schedule
NIST’s first post-quantum standards settled what to move to. Deciding what to move first is harder, and for banks, health systems and agencies the answer sits in a surprising place: the records retention schedule.
Week of 5 August 2024
How the August 2024 selloff found brokerages’ capacity limit before the first trade
As markets tumbled on August 5, 2024, customers of large retail brokerages struggled to log in and see balances. The strain sat before the first trade, in three layers with different owners: identity checks, account views and shared vendors. No rule set the target.
Week of 27 May 2024
Snowflake’s stolen logins put the contractor’s laptop inside the bank’s perimeter
The 2024 attacks on Snowflake customers broke nothing in the platform itself. They used passwords stolen from infected computers, often contractors’, and walked out with bulk data. Every step, from theft to login to extraction, was a lock the customer held.