Massimiliano Decarli

Author: Massimiliano Decarli

  • AI predicts better than you. The decision is still yours.

    In many fields, AI already forecasts better than we do. It reads more data, spots patterns faster and does not get tired at 6 pm. Demand planning, fraud detection, credit risk, maintenance schedules: given enough data, the machine often wins on accuracy.

    And yet, when the forecast is wrong, nobody blames the model. They ask who signed off.

    That gap between prediction and ownership is where the real change in the market is happening.

    The landscape is moving fast

    The World Economic Forum’s Future of Jobs Report 2025 expects 170 million new roles and 92 million displaced ones by 2030. Nearly 40% of the skills required on the job are set to change. Out of every 100 workers, 59 will need reskilling or upskilling, and 11 of them are unlikely to get it.

    Those numbers are not mainly about robots taking jobs. They describe jobs changing shape around a new colleague that is very good at one thing: predicting.

    AI predicts. Humans decide.

    In a study we presented at the EuroMed Academy of Business, we interviewed 13 experts and analysed 9 companies using AI for strategic decisions. The pattern was consistent. AI made decisions faster and better informed. But people wanted to understand how the system reached its answer, and they rejected handing over the final call.

    Our conclusion was a simple division of labour: let AI simulate the likely outcomes of each option, and let humans choose. Four years later, with far more capable models, I think that conclusion holds more strongly, not less.

    A model can tell you what will probably happen. It cannot tell you what you should want to happen.

    Ownership stays human for three reasons. Someone has to be accountable, to customers, regulators and colleagues. Someone has to weigh values the data does not contain. And someone has to notice when the world has changed and the model has not. Regulators agree: the EU AI Act requires human oversight for high risk AI systems.

    Upskilling is how people keep their purpose

    If AI takes over more of the predicting, what is left for us? The answer is not learning to code. It is learning to do the part machines cannot own:

    Framing the question. A precise question to an AI is worth more than a clever answer to a vague one.

    Judging the output. Knowing when a confident answer is wrong, and why.

    Owning the consequence. Turning a forecast into a decision you can explain and stand behind.

    People who build these skills do not compete with AI. They direct it. That is a purpose worth having, and it is why I believe upskilling is the most reliable way for individuals to stay relevant and engaged in the years ahead.

    What leaders can do now

    Treat AI literacy as core training, not an optional workshop. Make it clear who owns each AI assisted decision. And measure people on the quality of their judgement, not the volume of their output. Organisations that do this will get the accuracy of the machine and the accountability of the human. The rest will get neither.

  • Does your DDoS test look like a real attack?

    Most DDoS tests fire traffic from a handful of cloud data centres. Many real attacks look very different: they come from thousands of ordinary devices around the world, such as home routers, cameras and phones. If your test cannot imitate that, it may tell you far less than you think.

    Regulators now expect evidence. DORA asks financial entities to test their digital operational resilience, NIS2 raises the bar for critical infrastructure, and financial supervisors worldwide, FINMA among them, expect institutions to know how their systems behave under stress. So the real question is no longer whether to test. It is which test you can trust.

    How the market tests today

    Managed cloud simulation. Providers such as Red Button, RedWolf and NimbusDDoS generate controlled, multi vector attacks from cloud infrastructure, often with an expert in the room. They deliver volume and good process. The catch: the traffic comes from known cloud ranges, which can be far easier for a mitigation service to recognise than the residential and mobile traffic of a real botnet.

    Continuous non disruptive probing. MazeBolt sends small crafted probes around the clock to spot configuration gaps without downtime. Excellent for drift detection, but it does not show how your defences hold up under real load.

    Lab appliances. Keysight BreakingPoint offers enormous precision and thousands of attack signatures. It needs in house expertise and capital investment, and it typically runs inside your own environment rather than across the open internet.

    Open source tools. Fine for a lab. Not evidence you can hand to an auditor.

    What Obsidio does differently

    Obsidio orchestrates real, ethically sourced devices distributed worldwide instead of a few cloud load generators. Criminal botnets are built from hijacked machines. Obsidio’s network is not. The result is traffic that looks like a genuine attack, because it comes from the same kind of devices a genuine attack would use.

    Every test starts with ownership verification, typically a DNS TXT record, so nobody can point it at a system they do not control. Tests run inside Trusted Execution Environments with full audit logging, and you can abort instantly from live metrics. The final report is cryptographically signed and mapped to FINMA, DORA and NIS2, so an auditor can verify it independently.

    One question for any vendor

    Ask where the traffic comes from, and whether your mitigation provider would recognise it as a test. If the honest answer is yes, you are measuring how well your defences spot a drill, not how well they stop an attack.

    Descriptions of other providers are based on their public materials, such as Red Button and RedWolf, and on independent comparisons such as CyberDB’s 2026 overview. Corrections are welcome.