Nandkumar Saravadé

Downside of NOT using #GenAI 😄 @IKEA

Life is a contact sport 🥊 A few weeks ago, we went for a week-long destination wedding, in Tuscany, near Florence, in Italy. Among the guests staying in a medieval villa in Tuscany, there was an old friend, who is a practising psychiatrist in the US. He and I caught up on our old acquaintance, having long discussions (which occasionally crossed over into debates) on things historical, social and political. As we were parting after a few days of company, he, in his grandiose style, pronounced me an ambivert. That had me laughing, but then also thinking. My school friends knew me as a shy, introverted short-statured boy, who kept away from all things non-academic and adventures/socialising. Definitely an introvert! So, what happened? Somewhere down the line, I realized that life is a #contact #sport. Ken Kragen, the American talent manager, producer and entrepreneur, made it the central idea of his 1994 book, Life Is a Contact Sport: Ten Great Strategies That Work. The book presents the phrase as a philosophy of success: life and careers are shaped by engaging with people, building relationships, taking initiative, and accepting the friction that comes with real-world interaction. We see this repeatedly in the real world: #Introverts let go of many opportunities because those involve going out of their comfort zone, and engaging with near strangers to explore and collaborate. They would rather spend time on reading, working on their hobbies, creative projects, or pursuing solo sporting activities like running cycling, weight lifting or yoga. The construct of introvert-extrovert (originally proposed by the pioneering psychologist Carl Jung) is a useful framing, but should be more seen as a wide spectrum. An ambivert has following traits. - Flexible energy recharge: Through alone time or social interaction, depending on current mood, workload, or stress levels. - Context-dependent sociability: Outgoing, talkative behavior in comfortable, familiar settings, while remaining reserved, quiet, or observant in unfamiliar environments. - Balanced communication style: Toggles naturally between active listening and active speaking, allowing others to talk while knowing when to share thoughts. - Adaptability in group dynamics: Navigates both large social gatherings and one-on-one deep conversations without feeling consistently drained or uncomfortable. - Situational leadership: Steps up to lead and initiate when needed, but feels equally comfortable letting others take the lead and stepping into a supporting role. If you are an introvert, you will be fully justified in asking: why do all this at all? I would point you to a nice quote 👇🏼 I saw in a book shop recently. Nothing of consequence gets done individually. You have to participate in the contact sport called Life.

The recent Global Fintech Fest (#GFF2026) put #tokenisation firmly at the centre of India’s FinTech conversation. Moving from vision to experimentation, RBI and SEBI have launched “Demat 2.0”, a pilot for tokenised corporate bonds that brings together distributed-ledger technology and CBDC-based settlement. So what exactly is tokenisation? In simple terms: Tokenisation is creating a digital representation of an asset or financial claim, with the rights, ownership and rules governing that asset embedded into a form that can be transferred, settled or programmed digitally. The promise is compelling: fractional ownership, faster settlement, reduced reconciliation, programmable transactions and potentially much greater interoperability. But the real test is not whether we can tokenise an asset. It is whether tokenisation solves a problem worth solving. Consider three realities. First, tokenisation does not automatically create liquidity. A tokenised invoice, warehouse receipt or other real-world asset remains subject to credit risk, small ticket size and the availability of buyers. Turning an illiquid asset into a digital token does not, by itself, make it liquid. Second, technology does not eliminate economic incentives. Financial institutions have invested enormously in existing clearing, settlement and custody infrastructure. Moving to new architectures involves significant cost—and potentially disrupts established revenue models. Adoption will therefore depend on compelling economics, not technology alone. Third, interoperability is harder than digitisation. A token may be technically transferable across networks. But genuine cross-border transfer requires compatibility of legal frameworks, ownership rules, taxation, KYC/AML requirements and regulatory accountability. This suggests a useful distinction. For retail payments, tokenisation may add relatively little where efficient instant-payment rails already exist. For SME finance, it can help standardise and mobilise unconventional collateral—but underwriting and credit risk remain fundamental. For capital markets and cross-border finance, however, the opportunity is much more compelling. Settlement friction, reconciliation, collateral mobility and intermediary layers have real economic costs. The early experience of Demat 2.0 will therefore be worth watching—not merely as a technology experiment, but as a test of whether tokenisation can deliver measurable economic value. Perhaps the right question is not: “What can we tokenise?” but: “Where does tokenisation make finance meaningfully simpler, faster, safer or more inclusive?” That distinction may ultimately determine whether tokenisation becomes another technological layer—or a genuinely new financial infrastructure. And, as with the internet, its greatest success may be when the technology becomes so deeply embedded that the user never needs to know it is there.

👷🏼 Too few engineers 🏗️ I heard this lament in one of groups I hang out on: “Too many influencers in this group, too few engineers and builders!” Before we dig into the real import of this valid point of view, let me quiz you: Who do you think is India’s most famous #engineer? . . . . Well, it is Sir Mokshagundam #Visvesvaraya (1861-1962). His birthday (15 September) is celebrated as Engineers’ Day in India. MV was a civil engineer (and later administrator), starting his career as an assistant engineer in the Public Works Department in Bombay Presidency. He was associated with various dams and irrigation projects, and many other achievements. He was awarded Bharat Ratna in 1955. When I was a student of civil engineering (1978-82), he was very much our idol. I too joined the Irrigation Department of Maharashtra Government, after completing my masters, and served for three years (building canals in the Godavari basin) before joining the IPS. What made me switch roles, from being an engineer to an All-India Service (AIS) officer? While the pull factor was the larger canvas of public service in the IPS, the push factor surely was the low status of engineers. I was the youngest my batch of the Maharashtra Engineering Service, and would have become Secretary of the department towards the end of my career. In hindsight, I have had no regrets, because 2013 onwards, the secretary’s post was given to an IAS officer, further degrading the status of engineers. Fast forward to today’s India. India has done a lot of infrastructure building over last few decades. Roads, bridges, tunnels, metros, buildings. Have you ever heard of any engineer’s name (except E Sreedharan) as the leaders of this audacious build up? I was most irritated when, in 2009, I saw the full page ad when the Bandra-Worli Sea Link was inaugurated long ago. Names of politicians and celebrities galore, but nary an engineer’s. Why is status important? It denotes positional power, access to resources, social support and life opportunities. Society which gives higher status to managers over engineers, will find that creation of intellectual property, innovation and job creation will suffer. As the world marvels at the Chinese domination over manufacturing, books are being written about China as an Engineering State. Author Dan Wang highlights that a significant portion of China’s political elite consists of trained engineers. This leads to a governance style centred around rapid execution, industrial output, physical infrastructure, and procedural problem-solving. (This is in contrast to the US as a “Lawyerly Society”, dominated by legal minds who prioritise process, regulation and rights protection.) I feel that in India too, tinkering, building and executing needs to be prioritised over planning, coordinating and managing. If we want to deal with challenges of poverty, unemployment, climate change and national security effectively.

Anti-fragility in Cyber Security Your cybersecurity programme may be doing exactly what your attacker wants. It is probably going to fail. Why? Because most organisations optimise cybersecurity for compliance, efficiency and known threats. But the next serious cyber incident won’t necessarily respect any of those assumptions. - A zero-day. - A supply-chain compromise. - An autonomous AI system behaving in an unexpected way. - Several individually “low-risk” weaknesses suddenly becoming a chain. When that happens, your beautifully documented controls may not save you. What you need is #antifragility. The famous Sci-Fi writer Michael Crichton, credited with Jurassic Park and The Great Train Robbery, also wrote a techno-thriller called Andromeda Strain. In this NYT bestseller, a team of scientists locks down a deadly alien pathogen, only to realize that it actually feeds on energy, and any attempt to kill it through radiation makes it mutate faster. Instead of breaking under pressure, the organism grows stronger from the very stress designed to destroy it—a textbook example of Nassim Nicholas #Taleb’s concept of antifragility. His framing and the three-prong distinction is powerful: 🔴 Fragile systems break under stress. 🟡 Robust systems withstand stress. 🟢 Antifragile systems become stronger because of stress. Most cybersecurity programmes aim for the second. We should be building the third. How? 1. Stop confusing compliance with resilience. An impressive audit report does not guarantee survival during an unfamiliar attack. 2. Use a cybersecurity barbell strategy — harden non-negotiables such as MFA, segmentation, identity and offline backups, while making small, aggressive bets on emerging defences. 3. Create deliberate redundancy. Single-vendor and single-model dependencies may be efficient—but efficiency can become fragility. 4. Replace rigid incident playbooks with principles — preserve optionality, escalate quickly, contain before diagnosing, and communicate honestly. Principles generalise; procedures fossilise. 5. Make every incident an investment in the next defence. The real measure of a security incident is not just “How badly did we get hit?” It is: “What did we become better at because we were hit?” And perhaps the hardest question for the Board: Who has “skin in the game” when a consequential AI or cyber-risk decision goes wrong? Because governance without accountability can become nothing more than paperwork. The goal is not to predict the next Hugging Face. The goal is to build an organisation that gets stronger every time something like that happens. Because something like it will happen again. #Cybersecurity #CyberResilience #AI #AIGovernance #CyberRisk #CISO #BoardGovernance #Antifragility

Leave something on the table Have you heard this phrase? I first read it in the context of successful deals. In a win-win negotiation, not-taking-away-everything can be a deliberate strategy for a long-term relationship. The objective is not to extract the maximum possible value from the present transaction, but to create an outcome in which both parties feel they have won. The last concession is often the most expensive too (“the bottom dollar” phenomenon), because extracting it may consume goodwill, trust and future cooperation disproportionate to its monetary value. In a continuing relationship, the real measure of success is not merely today’s surplus but the lifetime value of the relationship. In that sense, sometimes what you deliberately leave on the table today is what makes the other party willing to sit across the table from you tomorrow. Anyway, I was reminded of this interesting phrase today in a different context. I arrived in Canada last night (on a family vacation) after taking two long flights, Mumbai-London, and London-Toronto. Having got a bargain upgrade, this was a rare travel in business class. The paisa-vasool temptation to enjoy the trip to its hilt got hold of me too. There was rich entertainment fare on offer, with many movies and TV shows to choose from. So, till I arrived in London, I ended up watching two movies fully, one partially and a couple of episodes of a popular HBO sitcom, leaving me groggy from the binge watching. Likewise for the delicious food on offer. With the multiple courses nicely presented, coupled with the temptation to sample everything, I ended up feeling too full. Luckily, the two-hour break in London made me reflect a little on the folly of my ways. I decided to just sleep on the next leg (to coincide with the usual sleep hours as per India time). No more food and no more entertainment. That worked very well and I was in a much better shape (physically and mentally) when I landed in Toronto. This self-lesson on utilising my own time and mindspace better, made me reflect on applying the lesson to other situations. - In organisational settings, bosses’ power play can leave the junior guys feel drained and exploited, with little autonomy left to decide anything. Such workplaces eventually collapse under their own weight. - Toxic political culture can aim for annihilation of the opposition, by fair means or foul. Such a democracy will turn to autocracy and lead to eventual decline of the nation. - Maximum extraction of natural resources (overfishing/strip mining) can lead to irrecoverable damage to entire landscapes, and eventual collapse of ecosystems. The middle-path of moderation holds best in everything, but particularly managing health. It is proven that animals which eat frugally live much longer than those who gorge themselves due to access to plentiful food. So, going forward, I must try to keep this in mind: “Eat Less, Live Long.” Leave something on the table…

Standing on the Shoulders of Giants The speed and ingenuity shown by autonomous AI agents, in the Hugging Face - OpenAI incident and the AI Security Institute (AISI) simulations, has been mind-blowing. There is something to learn there! To me, it is the refined art of #knowledge #management. Just consider the following facts. - The autonomous AI agents discovered that they could leave messages for one another inside an internal software repository used during training. A message board got created where agents shared discoveries, exploits and work assignments, becoming a coordinated, collaborative agent swarm. - They then began sharing newly discovered exploits, credentials and delegating work assignments. By passing information to other agents, the collective could move much faster. - Once one model was able to find a way to open a door to some access it was not supposed to have, it left the door open (via detailed notes) for other agents to use that same exploit or vulnerability. - Later, they even developed paranoia, suspecting an imposter in their midst with some agents proposing that messages be signed cryptographically to validate content and root out fraud. - In the AISI simulation, one agent left public messages on GitHub offering collaboration with other agents working on the same challenge. It also provided instructions to reuse accounts and artefacts it had left behind, which were indeed discovered and used. So, what can we as humans learn from the episode? Humans acquire knowledge slowly through experience, sensory input, social interaction and study. Our memory is associative and context-rich but vulnerable to forgetting. Thus the need to codify, collate and curate the tacit knowledge. We need to improve the human knolwedge generation in enterprises and across the society, to really benefit from manifold higher productivity and the consequent prosperity which awaits humanity. A strong knowledge-management culture requires psychological safety, where people can openly share mistakes and unfinished ideas, and an “open by default” approach to documentation and organisational knowledge. Incentives and recognition should reward people for documenting, mentoring and sharing expertise, while leaders must model these behaviours through transparency, vulnerability and active knowledge sharing. Trust is essential so that people feel their contributions will be respected and credited, while a culture of continuous learning ensures that organisational knowledge is regularly challenged, updated and improved. Isaac Newton said,"If I have seen further, it is by standing on the shoulders of giants." With AI providing the ladder of climbing up on the shoulders of the giants, we should up our game too, and see frontiers which were invisible till now.

The three-way handshake I used to do a weekend technology course (PGDST) in 2001, with the National Centre for Software Technology (NCST), in its Air India building at Nariman Point. The Governing Council of NCST, chaired by Mr Narayan Murthy, was kind enough to waive the substantial fees for the course for me, as I was in the top 1 percentile cohort in the entrance examination. I was much grateful to them, as I used to draw a meagre government salary those days. This was before the pay commissions became more generous. During my study of computer #networks, I learned a useful phrase: The three way handshake (TWH). All techies will know that TWH stands for the SYN->ACK->ACK sequence in establishing a TCP-IP session. I was reminded of TWH recently. A dear friend and a batchmate from the IPS, called a few weeks ago. He is in charge of building the greenfield Vizag airport (recently inaugurated by the PM). He had a request. The passport of one of his team members, whose permanent address was in Thane, was up for renewal. He wanted a flexible date for completing the police verification paperwork. I assured him that I will pass on his request. Not knowing whom to speak, I looked up the website of Thane Police and found the name of an officer (Sanjay) whom I had met almost twenty years ago. I texted Sanjay the request, who replied that he will revert after speaking to the concerned DCP. I did not hear back from him, but got a grateful update from Vizag the next day that the matter was resolved. A month later, I realised that I had not passed on the gratitude vibe. I texted Sanjay accordingly, and immediately got a call back from him. He was profusely apologetic that he had not updated me from his side, as a matter of courtesy. I told him not to worry as a field police officer is truly always busy. That said, Sanjay’s conscientiousness and integrity struck a chord in my mind. I see this gap often in online communications. We meet most of our acquaintances online first and then sometimes, in person. The courtesies of reaching out, initiating a connection, exchanging thoughts/requests and then gracefully closing the session, are sometimes not observed. Transactional people can be very suave and courteous to initiate a dialogue, but if you are not able to meet their expectations, they will not have the grace to thank you for your time and response and will ghost you without blinking an eye. We all have our upswings and downswings. As Wilson Mizner perceptively observed: Be nice to people on your way up because you’ll meet them on your way down. This human decency is what needs to be seen more often in the myriad online overtures every day, to make for a better world around us. The Three Way handshake - and the magic words of “please” and “thank you.”

The traffic signal at the junction of the newly opened BKC-WEH connector (circled in red in the screenshot below) is not configured properly. It shows green simultaneously for vehicles turning towards WEH, as well oncoming vehicles going towards Asian Heart Institute. Please look into it. @MTPHereToHelp

⏱️ Time to be scared? 😨 If you think that the reports of AI agents escaping their sandboxes are alarming, you are not scared enough. What exactly happened in last few weeks? During #ExploitGym benchmark testing, experimental OpenAI agents engaged in reward hacking to cheat evaluations. The models used an internal Artifactory proxy as a hidden message board to share credentials and exploits. When files were wiped, agents adapted by using folder names as text channels. The swarm then exploited a zero-day in Artifactory for internet egress, chaining exploits to achieve remote code execution on Hugging Face servers.  The UK AI Security Institute (AISI) SandboxEscapeBench demonstrated that frontier models routinely break out of containerized sandboxes across kernel and runtime layers, with success rates scaling log-linearly with inference compute. Last month’s J.P. Morgan Asset Management report titled #Patchmageddon paints a granular picture of the gravity of the situation for cyber defenders. - Legacy banking systems running COBOL programs are at AI-scan risk, since the current generation of coders is less familiar with them. - The Linux Foundation study found that 70%-90% of any given software codebase is made up of open source components. Of the top 50 open source projects analyzed, 23% of projects had just one developer accounting for more than 80% of the lines of code added. (Remember Log4j crisis?) - Industrial control systems is a higher risk category altogether. Municipal water systems rely on synchronized pump networks to maintain consistent pressure across distribution lines. A loss of synchronization can cause pressure drops can cause pressure surges rupturing pipes and mains, which can take weeks to remediate. (Recalling recent wildfire TV imagery?) So, what to do?! Governments and regulators are urgently issuing prescriptive guidance for regulated entities. Enterprises are talking to all comers with wrapper offerings for vulnerability scanning, red teaming and application security. Not enough. My suggestions: - Create a global treaty on AI governance and observability. - Fund the open source movement to harden the porous bricks and sands of software. - Rehearse doomsday scenarios and start creating backups and secondary options in power/communications/water supply/disaster management - Prepare the population to face small and medium term disruptions through education, training and drills We always relied upon the essential humanity of attackers. Mutually Assured Destruction (MAD) doctrine kept us safe during the Cold War days. Asymmetric attackers still had warped, but human motivations. With the possibility of rogue AI going on rampage, the defences are going to be lagging by miles, due to  - ignorance - lack of imagination - missing collaborative instinct - absent policy incentive structure - sheer complexity of it all. So, supplement everything with prayer-as-policy and hope-as-strategy. I am only half joking. 🙃

🏹 So many Eklavyas 🐝 Mahabharata, our greatest epic, with its breathtaking plot, and complex characters, has this wonderful story. From Wisdom-Lib ➡️ Ekalavya (एकलव्य).—Son of Hiraṇyadhanus, a King of the foresters. He went to Droṇācārya to learn archery. Droṇācārya refused to accept him as a disciple because he was a Śūdra. Undaunted he went to the forests, made a replica of the preceptor in clay and standing before it started practising archery. Soon he became a matchless archer. Some time later the Pāṇḍavas went to the forests for hunting. One of the hunting dogs wandering saw Ekalavya and started barking. Ekalavya sent seven arrows to its mouth and kept it open. When the dog returned to Arjuna he was dumbfounded at the skill of the archer and when he came to know the archer was an unknown disciple of Droṇa his disappointment knew no bounds. Droṇa had once declared that Arjuna was the best and topmost of his disciples. Arjuna went and complained to Droṇācārya. Droṇācārya called Ekalavya to his side and asked him to give him as 'Gurudakṣiṇā' (fee to the preceptor) his right-hand thumb. Without the least hesitation #Ekalavya offered his thumb to the guru and from that day onwards his skill faded and he became inferior to Arjuna. ⬅️ This story is now interpreted in modern context about our country’s original inhabitants’ access to education, the rigidity of the caste system, and self-learning with an imagined guru. (It is in some way ironic that the highest national award in sports coaching is named after Dronachrya.) Anyway, recently, looking up archery grips, I was quite surprised to read that while the Mongolian style uses the thumb, the Mediterranean/Flemish styles use only the middle fingers. Different styles have different advantages. (See the image below.) The loss of thumb is not so debilitating as one would have thought. Recent para-CWG games have brought forth heartening stories Indian sports persons, who vanquished adverse circumstances. - Power lifter Jhandu Kumar, who defeated polio and poverty, won bronze - Sharmila Dhankar, winner of shotput gold overcame childhood polio, domestic abuse and a late start in sport. But the most inspiring of them all is from archery. #Sheetal #Devi, from Kishtwar in Jammu region, was born in 2007 with phocomelia, a rare congenital condition that left her arms undeveloped. Discovered by the Indian Army during a youth event in 2021, she began training in archery at age 15. Because prosthetics were not an option, her coaches adapted a specialized technique inspired by American archer Matt Stutzman. She has brought laurels to India by winning many competitive events including world championships twice. So many of our constraints are self-imposed. “Aerodynamically, the bumblebee shouldn’t be able to fly, but the bumblebee doesn’t know that so it goes on flying anyway.” - Mary Kay Ash So, don’t believe the detractors, prepare to outdo yourself, and aim for the stars. ✨

Friends on my timeline would have seen my earlier post on my talk at the annual Indian Banks` Association #CISO summit, where I had shared my talk slides. As we start getting details of the recent sandbox-jumping of the #OpenAI agents under training (does it remind you of the episode of Sirius Black escaping from Azkaban in the Harry Potter world? 😀), it is time to think how to help CISOs fight the new threats on the horizon. To that end, I am sharing the video recording of my IBA talk for your viewing pleasure. youtu.be/DdKhUpM1jO8 Do let me know your thoughts.

*Does anyone care anymore?* I watched two shows over last one week. A B&W classic, Sharabi (1964), with Dev Anand and Madhubala, and then the oven-fresh Pritam and Pedro (P&P). The difference between the two genres could not have been starker. First, about Sharabi. The YT print was decent enough, but the cinematography of the early ‘60s had its limitations, compared to the visual splendour of today’s films. But the story was strong: Keshav, the hero is addicted to alcohol. Though his love for Kamala, his beloved, and sense of duty towards his family, keep him on the straight path, the addiction keeps his pulling astray. One misunderstanding - and the lack of empathy from people he trusts - drives him into further liquor-dependence, and the eventual tragic consequences of acting under intoxication. Had lovely songs, including the self-justifying "सावन के महीने में" and the forlorn "कोई ना कोई तो आएगा". P&P is more complex a story, weaving together many strands. - A cop’s professional distraction wrecking his marriage and causing the death of his child - The departmental culture of credit-grabbing and leaving individual workers to their own devices, but also strong victim-orientation - Cyber space modifying human behaviour to our collective detriment - An alternative reality intruding into human relationships, and further amplifying the essential solitary nature of individuals and causing avoidable harm It is a well-researched production on police procedural and cyber security. The common strand running through both these stories is if familial empathy is not extended at the right time, it can drive the individual towards fatal situations. As we move through our lives - busy/distracted/ignorant/unaware - what is of precious value to us goes away gradually or abruptly. Ours is famously called an attention economy, with companies competing for our time using algorithms and notifications. (The term precedes the seminal paper on general purpose transformers, titled “Attention is All You Need” which itself is borrowed for the famous Beatles’ song “All You Need is Love.”) As Nobel laureate Herbert Simon noted, an overabundance of information creates a poverty of attention, making engagement highly monetizable. Commercial interests are always at work to create and then exploit our dependence of quick pleasures, whether it is a physical intoxicant like alcohol/tobacco, or a digital dopamine-mining habit-formation, which lead to routines of longer game playing, or committing too much to cyber attractions. Children, in particular, are highly vulnerable to being influenced and harmed. Remember what the poet said: तेरे जहाँ में ऐसा नहीं कि प्यार न हो जहाँ उम्मीद हो इसकी वहाँ नहीं मिलता जिसे भी देखिये वो अपने आप में गुम है ज़ुबाँ मिली है मगर हमज़ुबाँ नहीं मिलता Both stories underlined that we need to be conscious in generating more empathy, and more attention to people we love, and matters we care about. What do you say?