Connect with us

Published

on

Businesses have been working hard to shift their culture internally to ensure they’re taking the threat of cyber breaches and outage incidents seriously.

Andrew Brookes | Image Source | Getty Images

New European Union regulations requiring businesses to bolster their cyber defenses is off to a slow start as many member states have failed to adopt the rules in time to meet a key enforcement deadline, according to research monitoring the progress of the directive.

The EU’s NIS 2 cybersecurity directive sets a high benchmark for companies over their internal cybersecurity systems and practices. It imposes tougher requirements around risk management, transparency obligations and business continuity planning, in the event of a cyber breach.

On Thursday, the new directive officially became enforceable by member states. That means firms have to now ensure their operations are up to scratch with the rules. However, most EU member states have yet to implement NIS 2 in their own respective national laws, meaning that enforcement is likely to be spotty.

Two countries — Portugal and Bulgaria — haven’t begun the transposition process for NIS 2, where directives are incorporated into the national laws of EU member states, according to a tracker tool from internet research organization DNS Research Federation. The governments of Portugal and Bulgaria were not immediately available for comment when contacted by CNBC Wednesday.

“The implementation status varies significantly across the bloc,” Tim Wright, partner and technology lawyer at Fladgate, told CNBC via email.

What is NIS 2?

NIS 2 — or the Network and Information Security Directive 2 — is an EU directive that aims to increase the security of IT systems and networks across the bloc. First proposed in 2020, the law serves as an update to an earlier directive simply called NIS.

NIS 2 expands the scope of its predecessor to address more recent cybersecurity challenges and threats, as criminals have found new ways to hack companies and compromise their sensitive data.

The directive applies to organizations that operate within the EU and provide essential services to consumers, including banks, energy suppliers, health care institutions, internet providers, transport firms, and waste processors.

Watch CNBC's full exclusive interview with Google Cloud CEO Thomas Kurian and Accenture CEO Julie Sweet

Businesses will have a “duty of care” to report and share information on cyber vulnerabilities and hacks with other companies under the new regulation — even if it means owning up to being a victim of a cyber breach.

If a business falls victim to a cyber breach, they’ll have 24 hours to submit an early warning notification to authorities — a stricter timeline than the 72-hour window firms have to notify authorities about a data breach under the General Data Protection Regulation, a separate data privacy law in the EU.

Firms will also have to vet their technology vendors one by one for cyber threats and vulnerabilities.

Will it be effective?

Fladgate’s Wright said that effectiveness of NIS 2 as a regulation will largely depend on consistent implementation and enforcement across EU member states.

“Bad actors may target countries lagging in their NIS2 transposition or look for weaknesses in supply chains, targeting smaller, less-secure vendors and suppliers to gain access to larger, better-protected organisations,” he told CNBC.

Businesses have been working to get their internal processes, controls and broader culture around cybersecurity into shape for years ahead of the Thursday deadline.

Chris Gow, enterprise tech firm Cisco’s EU public policy lead, said that the spotty nature of NIS 2’s implementation has also been “exacerbated by local adaptation of the law.”

This, in turn, is “creating discrepancies that can prove difficult to navigate, especially for smaller organisations with limited resources,” Gow told CNBC in emailed comments.

State-backed cyber attacks are on the rise this year: DXC Technology

He recommended that, rather than being “overwhelmed” by discrepancies in local adaptations of NIS 2, organizations should “identify a common core of security controls and processes that stand them in good stead to both meet and demonstrate compliance at scale.”

What if a company fails to comply?

For “essential” entities like transport, finance and water companies, failure to comply with NIS 2 can lead to fines of up to 10 million euros ($10.9 million) or 2% of global annual revenues — whichever ends up higher.

Meanwhile, “important” businesses — such as food companies, chemicals firms, and waste management services — are looking at fines of up to 7 million euros or 1.4% of their global annual revenues for breaches.

Firms can also face possible suspensions of service if they fail to comply with NIS 2, as well as closer supervision.

“NIS 2 makes it clear – large fines, possible suspension of service and monitoring of compliance are being used as levers to encourage organisations responsible for critical services to pay attention to cybersecurity threats and their response to those,” Carl Leonard, EMEA cybersecurity strategist at Proofpoint, told CNBC.

“A baseline has been set in terms of risk-management and mitigation measures including incident handling, staff training, leadership accountability and many others,” Leonard added.

Continue Reading

Technology

AWS’ custom chip strategy is showing results, and cutting into Nvidia’s AI dominance

Published

on

By

AWS' custom chip strategy is showing results, and cutting into Nvidia's AI dominance

AWS announces new CPU chip: Here's what to know

Amazon Web Services is set to announce an update to its Graviton4 chip that includes 600 gigabytes per second of network bandwidth, what the company calls the highest offering in the public cloud.

Ali Saidi, a distinguished engineer at AWS, likened the speed to a machine reading 100 music CDs a second.

Graviton4, a central processing unit, or CPU, is one of many chip products that come from Amazon’s Annapurna Labs in Austin, Texas. The chip is a win for the company’s custom strategy and putting it up against traditional semiconductor players like Intel and AMD.

But the real battle is with Nvidia in the artificial intelligence infrastructure space.

At AWS’s re:Invent 2024 conference last December, the company announced Project Rainier – an AI supercomputer built for startup Anthropic. AWS has put $8 billion into backing Anthropic.

AWS Senior Director for Customer and Project Engineering Gadi Hutt said Amazon is looking to reduce AI training costs and provide an alternative to Nvidia’s expensive graphics processing units, or GPUs.

Anthropic’s Claude Opus 4 AI model is trained on Trainium2 GPUs, according to AWS, and Project Rainier is powered by over half a million of the chips – an order that would have traditionally gone to Nvidia.

Read more CNBC tech news

Hutt said that while Nvidia’s Blackwell is a higher-performing chip than Trainium2, the AWS chip offers better cost performance.

“Trainium3 is coming up this year, and it’s doubling the performance of Trainium2, and it’s going to save energy by an additional 50%,” he said.

The demand for these chips is already outpacing supply, according to Rami Sinno, director of engineering at AWS’ Annapurna Labs.

“Our supply is very, very large, but every single service that we build has a customer attached to it,” he said.

With Graviton4’s upgrade on the horizon and Project Rainier’s Trainium chips, Amazon is demonstrating its broader ambition to control the entire AI infrastructure stack, from networking to training to inference.

And as more major AI models like Claude 4 prove they can train successfully on non-Nvidia hardware, the question isn’t whether AWS can compete with the chip giant — it’s how much market share it can take.

The release schedule for the Graviton4 update will be provided by the end of June, according to an AWS spokesperson.

Continue Reading

Technology

JPMorgan moves further into crypto with stablecoin-like token JPMD

Published

on

By

JPMorgan moves further into crypto with stablecoin-like token JPMD

Jamie Dimon, Chairman and CEO of JPMorgan Chase & Co., speaks to the Economic Club of New York in Manhattan, New York City, on April 23, 2024.

Mike Segar | Reuters

JPMorgan Chase is taking a step further into the cryptocurrency space with its own stablecoin-like token, called JPMD.

The U.S. banking giant told CNBC on Tuesday that it’s planning to launch a so-called deposit token on Coinbase’s public blockchain Base, which is built on top of the Ethereum network. Each deposit token is meant to serve as a digital representation of a commercial bank deposit.

JPMD will offer clients round-the-clock settlement as well as the ability to pay interest to holders. It is a so-called “permissioned token,” meaning it is only available to JPMorgan’s institutional clients — unlike many stablecoins, which are publicly available.

“We see institutions using JPMD for onchain digital asset settlement solutions as well as for making cross-border business-to-business transactions,” Naveen Mallela, global co-head of Kinexys, J.P. Morgan’s blockchain unit, told CNBC Tuesday.

“Given the fact that deposit tokens would eventually be interest bearing as well, this would provide better fungibility with existing deposit products that institutions currently use,” he added.

Deposit token vs. stablecoin

JPMorgan said the benefit of launching a deposit token over a stablecoin is that it gives institutional clients a way to move money around faster and easier while still having a close connection with traditional banking systems.

A stablecoin is a type of digital token that’s designed to be pegged 1:1 to the value of a fiat currency at all times. The most popular stablecoins are Tether’s USDT and Circle’s USDC. The entire stablecoin market is worth approximately $262 billion, according to data from CoinGecko.

In the U.S., stablecoins remain broadly unregulated — although this is likely to change soon. The Senate is set to vote Tuesday on the GENIUS Act, legislation that would introduce formal regulation for such tokens.

Elsewhere, the European Union regulates stablecoins under its Markets in Crypto-Assets Regulation, or MiCA, while the U.K. has also laid out plans to regulate the crypto industry. Britain’s Financial Conduct Authority is currently consulting on proposals to require stablecoin issuers to ensure their tokens maintain their value against a given asset.

Read more CNBC tech news

JPMorgan’s digital asset chief told CNBC that the bank chose Coinbase as its blockchain partner since the crypto exchange is already a long-standing client and a leader in the crypto space.

JPMD has had “preliminary interest from large institutional players who want more native onchain cash solutions from pre-eminent and reputed financial institutions,” Mallela added.

Speculation had been building around JPMorgan’s new crypto offering after a trademark application filed by the bank for “JPMD” was made public Monday.

The trademark outlined a broad range of crypto services under the JPMD name, including trading, exchange, transfer and payment services for digital assets.

Various crypto media outlets had speculated whether the bank was about to launch its own stablecoin. However, JPMorgan says that, while its token may share some similarities with a stablecoin, it’s ultimately a different kind of product.

Watch CNBC’s full interview with JPMorgan CEO Jamie Dimon

Continue Reading

Technology

Canva expands from design into analytics with acquisition of MagicBrief

Published

on

By

Canva expands from design into analytics with acquisition of MagicBrief

From left, Cliff Obrecht, Canva’s co-founder and chief operating officer, and George Howes, co-founder and CEO of MagicBrief, pose for a photo at the Cannes Lions festival in Cannes, France, in June 2025.

Canva

Canva has grown into a $32 billion startup through its popular design tools used for easily creating images, marketing material and presentations.

Now the company, with its 12th acquisition, is buying its way into the analytics market.

Canva said on Tuesday that it’s buying MagicBrief, whose technology is used for analyzing ad performance, for an undisclosed sum. With MagicBrief, companies can track spending and engagement on their ads and see what’s working well for competitors.

Around 240 million people use Canva’s products, which compete with offerings from Adobe’s Creative Cloud. The company has been deepening its capabilities in artificial intelligence, incorporating it into photo editing, coding and by incorporating chatbots.

“We feel like, especially with AI, we can really democratize marketing and allow marketers to do a lot more with less,” Cliff Obrecht, Canva’s co-founder and chief operating officer, said in an interview.

Canva, which ranked fifth on CNBC’s latest Disruptor 50 list, has raised over $560 million, and was valued most recently at $32 billion, though that’s a step down from its peak of $40 billion in 2021, when private markets were at their frothiest. Obrecht said the company has $1 billion in the bank.

Canva plans to incorporate MagicBrief into a broader product that it will announce later this year, Obrecht said. In October, Adobe announced the availability of a tool for creating ads with AI and then tracking performance.

Meanwhile, Alphabet, Amazon, Meta and Reddit are all pushing generative AI systems to boost the reach of online ads. Some marketers have used Meta’s offerings to tweak the visual appearance of their ads with hopes of gaining traction with certain audiences, CNBC reported in December.

Founded in 2022, MagicBrief has 14 employees and is based in Canva’s hometown of Sydney, Australia. In 2023, the company announced a $2 million funding round, with investments from Archangel and Blackbird, which was Canva’s first investor. The startup has tens of millions of dollars in annualized revenue, Obrecht said.

Canva, which started up in 2013, has 5,500 employees, with over $3 billion in annualized revenue. It’s one of the companies that venture capitalists are most excited about as an IPO candidate, but Obrecht said there won’t be an offering this year.

The focus, he said, is winning “over the next 10 years,” and not just hitting quarterly numbers.

“We feel that’s very short-sighted, and public markets do gravitate you more to quarter-on-quarter performance,” he said.

— CNBC’s Jonathan Vanian contributed to this report.

WATCH: The design space overall has a lot of room to run, says Bessemer Venture Partners’ Elliott Robinson

The design space overall has a lot of room to run, says Bessemer Venture Partners' Elliott Robinson

Continue Reading

Trending