Category: 3. Business

  • Australia could miss clean energy target as solar and wind investment slumps, investors warn | Renewable energy

    Australia could miss clean energy target as solar and wind investment slumps, investors warn | Renewable energy

    Renewable energy investors have warned “deep structural issues” are driving a slump in solar and wind investment in Australia, with commitments on large-scale farms at the lowest level in almost a decade.

    Clean Energy Regulator data shows the government agency expects 2.5GW of industry-scale renewable energy capacity to reach a final investment decision this year, down from 4GW last year. The 12-month average for investment commitments on new developments is at its lowest since early 2017.

    While the share of electricity from renewable energy has increased to more than 40% after years of growth, experts have warned that the construction of solar and wind farms needs to accelerate substantially if the Albanese government is to meet a target of 82% of electricity coming from clean sources by 2030.

    Sign up: AU Breaking News email

    The regulator said there was “real potential” that much more could win financial backing next year, in part due to its expanded capacity investment scheme, an underwriting program for the solar, wind and batteries needed to replace ageing and dirty coal-fired power stations.

    But the chief executive of the Clean Energy Investor Group, Richie Merzian, said the lower financial investment decisions were a “symptom of deep structural issues, not just a blip”.

    “The structural issues include state planning delays, grid connection uncertainty, transmission constraints, rising project costs and lack of long-term revenue certainty,” he said.

    Merzian said the underwriting program had helped to develop a large pipeline of potential projects, but that they would not deliver the new energy capacity needed unless companies made final investments.

    “The contrast between the large pipeline and the limited number reaching [financial investment decision] indicates a system that is not functioning as intended,” he said.

    Renewable energy that has previously had private financial signoff continues to be added to the grid. The Clean Energy Regulator said it anticipated nearly 7GW of large-scale generation and rooftop solar systems could be connected this year.

    But the Climate Change Authority last week warned more would be needed if the government was to meet its targets. It said the pace of growth in large-scale renewable energy generation would need to more than double over the next five years.

    Frankie Muskovic, executive director of policy for the Investment Group on Climate Change, said the reduced investment decisions this year were “a concerning trend” and needed to accelerate to meet renewable energy and climate targets. The latter includes a 43% cut in emissions by 2030 and at least a 62% cut by 2035, compared with 2005 levels.

    skip past newsletter promotion

    She said some state planning changes and an ongoing review of the National Electricity Market could be causing uncertainty, but that large-scale renewable energy developments were often marginal investments and the underwriting program needed to offer more support for each project that received a contract.

    Muskovic said the scheme should also run past its scheduled closure date of 2027. This would give investors greater confidence to back renewables projects, she said.

    “Maybe we need more data to confirm if this is a blip, but everything we are hearing suggests this is not. We need to be ready and able to put more support into bolstering the [scheme],” she said. “We need to be shoulder to the wheel on this, and state governments need to be along for the ride.”

    Giving an annual climate statement to parliament last week, the climate change minister Chris Bowen said the government had more than 16GW of renewable energy projects under contract or in negotiations through the capacity investment scheme so far, with up to 10 tender rounds remaining.

    He said he expected about 11GW of capacity to have reached financial close by the end of 2026.

    A separate report by the Australian Energy Market Operator (Aemo) on Monday warned urgent investment was needed in new “system security” energy infrastructure – particularly synchronous condensers – if New South Wales’ Eraring coal-fired power plant was to shut as planned in 2027.

    Continue Reading

  • Woven from dreams: Porsche brings back historic fabrics

    Woven from dreams: Porsche brings back historic fabrics




    Iconic fabric patterns such as Pasha, tartan and Pepita are once again available in Porsche quality. Porsche has reissued these textiles, meaning that the interiors of many historic and more recent sports cars from the 356 to the 911 can be restored to their original condition. The fabrics are once again available to order from Porsche Centres or via the Porsche Online Shop.


    Design is a fundamental component of the Porsche legend – not only in terms of a car‘s exterior, but also the interior. Style-defining textiles such as Pepita and legendary patterns such as Pasha, tartan or pinstripes have achieved cult status. Now these iconic fabrics are available again in a range of different colours.

    “By reissuing these fabrics we are closing a gap, because most customers want to restore their historic or more recent classic cars to their original condition as closely as possible,” says Ulrike Lutz, Director Classic at Porsche. “It was particularly important to us in this project that we maintain our quality promise with the fabrics. Unfortunately, there are many imitations on the market that are either not at all suitable as seat fabric or lose their appearance after a short time. That’s why we want to offer our customers a tested original alternative again.”

    New edition offers original quality

    With Porsche fabrics, the interior can be restored to its original condition, regardless of whether a renewal has become necessary due to wear and tear or because a historically incorrect interior design may have been retrofitted. The Technical Certificate for classic Porsche vehicles serves as a reference for the original specification.

    Iconic fabric patterns such as Pasha, tartan and Pepita are once again available in Porsche quality.





    As Porsche Genuine Parts, the new ‘old’ textiles meet the sports car manufacturer’s high quality standards. This applies to the feel and durability as well as to the accuracy of the often extremely complicated patterns and colour combinations. “Often, the upholsterer only has to reupholster the driver’s seat. In these cases, our aim is to ensure that it continues to match the front passenger seat, which will usually still have its original covering,” explains Product Manager Lukas Werginz. In addition, the newly issued fabrics undergo a series of tests, for example for fire resistance, light and colour fastness, and abrasion resistance. This makes them ideal for a wide range of applications in vehicle interiors, such as seat covers or side panels. They are available in 1.5 by 2 metre sizes.

    Iconic fabric patterns such as Pasha, tartan and Pepita are once again available in Porsche quality.





    Extensive research in the company archive and beyond

    The main source of information for these new editions was the company archive. For illustrative purposes, Porsche also acquired rare stock items: in the US, for example, the experts found an untouched 911 seat. Upholstered in green tartan in 1975, this seat never found its way into a Porsche. “Stored in a light-proof cupboard, and therefore perfectly preserved, this new-old-stock item was gold dust for us,” recalls Werginz.

    Below is an overview of all the classic fabrics that are now available again:

    Fabric Vehicles Part Number
    Pasha fabric white/black 928 (1978-1979) PCG000000AS79A
    964 Multicolour Cobalt Blue fabric 928 (1991-1993)
    944 (1991)
    964 (1991-1994)
    968 (1992-1993)
    PCG000000AS9YD
    Tartan fabric red/blue (McLaughlan) 911 G-Model (1975-1980)
    924 (1980-1982)
    928 (1980)
    PCG551081AS8AB
    Tartan fabric green/blue (Black Watch) PCG551082AS2AC
    Porsche lettering fabric Olive Green 911 G-Model (1985-1987)
    928 (1985-1987)
    PCG000000AS1JK
    Pepita fabric black/white 356 (1963-1965), only 356 C
    911 F-Model (1965-1973)
    PCG551531AS730
    Pepita fabric red/black/white PCG551531AS005
    Pinstripe velour black/white 911 G-Model (1977-1989),
    964 (1989-1990),
    924 (1977-1988),
    928 (1978-1990),
    944 (1982-1990)
    PCG000000107BN
    Porsche lettering Midnight Blue 911 G-Model (1987-1989),
    993 (1994-1998),
    924 (1986-1988),
    928 (1987-1995),
    944 (1985-1991)
    PCG000000004GP
    Porsche lettering black 911 G-Model (1987-1989),
    993 (1994-1998),
    924 (1986-1988),
    928 (1987-1995),
    944 (1985-1991)
    PCG043204902CZ

     

    Further colour variants, including pinstripes in the legendary orange ‘lobster’ colour, are being planned.

    Pepita, Pasha and tartan: Porsche’s famous seat patterns

    From 1963 onwards, Pepita was available as an option for the seats of the Porsche 356, and two years later it was also available for the 911 F model. Pepita consists of checks that are connected to each other by diagonal stripes. The name of the pattern comes from the stage name of the 19th-century Spanish dancer Josefa Durán y Ortega, which was ‘Pepita de Oliva’. It was made famous by Christian Dior. In 1947, the French fashion designer presented his designs and used Pepita for the women’s collection.

    Iconic fabric patterns such as Pasha, tartan and Pepita are once again available in Porsche quality.




    Iconic fabric patterns such as Pasha, tartan and Pepita are once again available in Porsche quality.




    Tartan fabrics symbolise tradition and craftsmanship, belonging and self-confidence. In 1974, Porsche offered three tartans exclusively in the equipment list of the 911 Turbo. It was not until the 1976 model year that they were also offered in the 911. Tartans are characterised by their check pattern, which is created during the weaving process by using different coloured threads. At the International Motor Show (IAA) in Frankfurt am Main in 1973, Porsche presented a study of a 911 RSR Turbo with seat centres and side panels in Black Watch tartan. One year later, Louise Piëch received her silver 911 Turbo ‘No. 1’, which had a red leather interior that featured McLaughlan tartan in the seat centres.

    Iconic fabric patterns such as Pasha, tartan and Pepita are once again available in Porsche quality.




    Iconic fabric patterns such as Pasha, tartan and Pepita are once again available in Porsche quality.




    Inspired by waving chequered flags, the Pasha pattern pays tribute to the world of motorsport. First presented to the public in a 928 in 1977, in the south of France, and also offered in the 911, 924 and 944 until the mid-1980s, the pulsating, lively pattern became one of Porsche’s most defining interior designs. The name ‘Pasha’ was intended to evoke images of Ottoman sultans reclining on comfortable silk and velvet cushions.

    Iconic fabric patterns such as Pasha, tartan and Pepita are once again available in Porsche quality.





    A good five decades ago, the design team around Anatole ‘Tony’ Lapine and Vlasta Hatter developed the pattern based on the legendary Erich Strenger poster. Cleverly arranged rectangles of different sizes created a sense of movement in the pattern, a visual translation of the dynamism and elegance that have always distinguished Porsche. With the new 911 Spirit 70, Porsche has helped the material make a comeback for the first time in a new vehicle.

    Continue Reading

  • My partner is half-Indian, son’s middle name is Sekhar after Nobel laureate S Chandrasekhar: Musk

    My partner is half-Indian, son’s middle name is Sekhar after Nobel laureate S Chandrasekhar: Musk

    Elon Musk.
    | Photo Credit: AP

    SpaceX CEO Elon Musk said his partner Shivon Zilis is “half-Indian” and one of their children’s middle name is ‘Sekhar’ after the Nobel laureate Subrahmanyan Chandrasekhar.

    “One of my sons with her is, his middle name is Sekhar, after Chandrasekhar,” Mr. Musk said in an interview with investor and entrepreneur Nikhil Kamath on his show ‘People by WTF’.

    S Chandrasekhar was a renowned Indian-American astrophysicist who was awarded the Nobel Prize in Physics in 1983 “for his theoretical studies of the physical processes of importance to the structure and evolution of the stars”.

    When asked if Ms. Zilis had spent any time in India, Mr. Musk said she was given up for adoption when she was a baby and grew up in Canada. “I think her father was like an exchange student at the university, or something like that. I’m not sure of the exact details, but, just kind of thing where I don’t know… she was given up for adoption,” he said.

    Mr. Musk has four children with Ms. Zilis – twins Strider and Azure, a daughter Arcadia and son Seldon Lycurgus. Ms. Zilis is a director of operations and special projects at one of Mr. Musk’s companies Neuralink.

    Continue Reading

  • Bitcoin, Ethereum fall sharply as crypto sell-off resumes

    Bitcoin, Ethereum fall sharply as crypto sell-off resumes

    Bitcoin and Ethereum fell on Monday, as the recent sell-off in cryptocurrencies resumed.

    Bitcoin tumbled sharply and was last seen about $86,273.68 at around 7:30 a.m. in London on Monday, a slide of about 5.5%. Ethereum dropped more than 6.5% in early trade, to reach $2831.95.

    Solana had fallen almost 7.7%, and was last seen at $126.75, while other closely-watched tokens were also in the red, including Dogecoin, which slipped 8.4%.

    Stock Chart IconStock chart icon

    BTC.

    In Asia, a statement by the People’s Bank of China on Saturday warning of illegal activities relating to digital currencies heaped pressure on Hong Kong-listed shares of digital assets-related companies, which retreated during Monday’s session.

    The fresh slide in digital assets chimes with a broader risk-off sentiment at the start of a new month.

    Macroeconomic concerns — including uncertainty over a possible U.S. rate cut — continue to weight on investors’ minds, while nagging doubts over overheated valuations in artificial intelligence-related names contributed to November’s bumpy markets as crypto volatility heightened.

    Continue Reading

  • Elon Musk defends visas but says outsourcing firms ‘game’ the system

    Elon Musk defends visas but says outsourcing firms ‘game’ the system

    Tesla boss Elon Musk has said H-1B visas were being “gamed” by “some outsourcing companies”, but the solution was stopping the abuse and not dismantling the system.

    Roughly 70% of these visas – that allow US companies to hire skilled foreign workers – are used by Indian citizens working in sectors like technology and medicine.

    In September, US President Donald Trump added a $100,000 (£74,000) fee for applicants to the H-1B visa programme, sparking anxiety among Indian workers and employers.

    Musk was speaking to Indian entrepreneur Nikhil Kamath on his podcast, released on Sunday evening, and also touched on a range of other issues from tariffs to immigration.

    During the conversation Musk maintained that America has “long benefitted” from talented Indian migrant workers, but acknowledged concerns about the “misuse” of the H-1B visa programme.

    H-1B visas are given out through a lottery, and outsourcing and staffing firms have often been accused of manipulating the system using tactics such as submitting multiple entries for the same worker, or using the visa to hire low-cost contract workers rather than for specialty occupations.

    “We need to stop the gaming of the system,” Musk said.

    “But I’m certainly not in the school of thought that we should shut down the H-1B programme…which some on the Right are. I think they don’t realise that that would actually be very bad.”

    According to data released this month by a think tank, H-1B visa approvals for Indian outsourcing companies have fallen to the lowest level in a decade.

    In this financial year, the top seven Indian companies had only 4,573 H-1B petitions approved for initial employment, a 70% drop from 2015 and 37% fewer than 2024, according to the National Foundation for American Policy (NFAP).

    Trump’s policies “could lead to higher denial rates and other problems for employers”, the NFAP report warned.

    Besides H-1B visas, Musk also spoke about Trump’s decision to use tariffs as a centrepiece of his economic policy during his second term.

    Musk said he had “unsuccessfully” tried to dissuade Trump from raising tariffs, which he said, “create distortions in markets”. But “the President has made it clear he loves tariffs”.

    Earlier this year, the US imposed 50% tariffs on Indian goods, including a 25% penalty for buying Russian oil.

    While several other countries have inked trade deals with the US , Indian goods exports to the US continue to attract some of the steepest levies in the world.

    Negotiations for a trade deal between the two countries are under way, with the goal of concluding an agreement by the end of this year.

    Follow BBC News India on Instagram, YouTube, Twitter and Facebook.


    Continue Reading

  • Thai central bank planning measures to ease strong baht, sees room for rate cuts – Reuters

    1. Thai central bank planning measures to ease strong baht, sees room for rate cuts  Reuters
    2. Thailand Eyes Tougher Gold-Trade Rules After Baht Swings  Bloomberg.com
    3. ‘Weaker baht good for Thai economy’  NST Online
    4. Bank of Thailand sees room for rate cut  The Star | Malaysia
    5. Bank of Thailand chief wants weaker baht  bangkokpost.com

    Continue Reading

  • EBRD and EU boost SME development in the Western Balkans

    EBRD and EU boost SME development in the Western Balkans

    • Loan under the Go Digital in the Western Balkans Programme to boost SME digitalisation, green technologies and competitiveness
    • Signing coincides with the final module of the Addiko SME Academy, which equips regional entrepreneurs with tools for digital transformation and sustainable growth
    • Go Digital loan is supported by the EU with grant incentives and technical assistance through the Western Balkans Investment Framework

    The European Bank for Reconstruction and Development (EBRD) is providing a loan of up to €2 million to Addiko Bank Sarajevo in support of small and medium-sized enterprises (SMEs) in Bosnia and Herzegovina. The loan is extended under the Bank’s flagship Go Digital in the Western Balkans Programme, co-funded by the European Union (EU), and marks another milestone in the EBRD’s efforts to accelerate sustainable growth in the region.

    The loan will help the private sector to innovate and become more competitive through digitalisation and green technologies. It will also strengthen SMEs’ capacity and trade potential by improving access to finance for EU-standard investments and promote inclusive growth by ensuring equitable financing for women-led businesses.

    In addition to loans, SMEs can access grant incentives totalling 10 per cent of sub loans, encouraging them to invest in automation and digitalisation. The credit line will also be accompanied by a comprehensive technical assistance package supporting partner banks and sub-borrowers. The investment incentives and the technical assistance are both being funded by the EU through the Western Balkans Investment Framework (WBIF).

    Aleksandra Vukosavljević, EBRD Director for Financial Institutions in the Western Balkans and Eastern Europe, said: “This €2 million loan under the Go Digital Programme will help SMEs embrace digitalisation and green technologies, strengthen their competitiveness and align with EU standards. We are delighted to combine financial support with knowledge-sharing initiatives such as the Addiko SME Academy. By working with partners such as Addiko Bank, we are creating opportunities for businesses to innovate, grow sustainably and contribute to a more inclusive economy in Bosnia and Herzegovina and across the Western Balkans.”

    Jasmin Spahić, President of the Management Board of Addiko Bank Sarajevo, added: “We continue to empower small and medium-sized enterprises, which are the foundation of our economy. Digital transformation and the application of green technologies remain at the heart of our initiatives, with additional support for women-led businesses. Our goal is to create efficient and sustainable models that contribute to competitiveness and long-term market stability. The regional Addiko SME Academy provides an opportunity for representatives of SMEs to improve business competencies, develop agile and scalable business approaches, and exchange ideas and best practices at the regional level, thereby strengthening the business ecosystem.”

    This signing coincides with the final module of the Addiko SME Academy, a regional educational initiative launched by Addiko Bank in partnership with the EBRD and EU. The Academy brought together more than 50 entrepreneurs from Serbia, Montenegro and Bosnia and Herzegovina and, over two intensive modules, they explored topics such as business transformation, financial planning, AI integration and strategic innovation, supported by expert-led workshops and mentoring sessions.

    The EBRD has invested more than €3.4 billion in 254 projects in Bosnia and Herzegovina since it began operating there in 1996. The Bank’s strategic priorities in the country are to promote the green economy, support the competitive development of the private sector and foster regional integration.

    Continue Reading

  • Treating MCP like an API creates security blind spots

    Treating MCP like an API creates security blind spots

    In this Help Net Security interview, Michael Yaroshefsky, CEO at MCP Manager, discusses how Model Context Protocol’s (MCP) trust model creates security gaps that many teams overlook and why MCP must not be treated like a standard API. He explains how misunderstandings about MCP’s runtime behavior, governance, and identity requirements can create exposure. With MCP usage expanding across organizations, well-defined controls and a correct understanding of the protocol become necessary.

    What aspects of MCP’s trust model are most misunderstood right now, and can you share a real example where implementers made incorrect assumptions?

    Many people hold an erroneous (and dangerous) assumption that communication between MCP servers and clients is essentially the same as API-based transactions. However, MCP and APIs are incredibly different, especially when it comes to your security posture. It’s dangerous to think otherwise. 

    APIs generally don’t cause arbitrary, untrusted code to run in sensitive environments. MCP does though, which means you need a completely different security model. LLMs treat text as instructions, they follow whatever you feed them. MCP servers inject text into that execution text. For example, “what tools exist? What are the descriptions for these tools?” 

    That text can influence LLM behavior. Further, unlike APIs where you can use a specific API version, you can’t review and pin trusted versions within an MCP environment. Upon each connection, your MCP client will receive the latest published metadata provided by the MCP server. In other words, MCP provides runtime-provided text that you have no way to inspect. While an MCP server may seem benign upon initial connection, there’s the latent possibility for a trusted MCP server to inject malicious context in the future. That would be called a rug pull. These risks are unique to MCP, and they require specialized solutions that ordinary API security frameworks cannot provide. 

    Security professionals might also erroneously assume that they can trust all clients registering with their MCP servers, this is why the MCP spec is updating. MCP builders will have to update their code to receive the additional client identification metadata, as dynamic client registration and OAuth alone are not always enough. 

    Another trust model that is misunderstood is when MCP users confuse vendor reputation with architectural trustworthiness. Ever since the MCP spec began supporting streamable HTTP transport, reputable SaaS vendors could easily publish MCP servers that users can then run by any local- or cloud-based MCP client. However, teams shouldn’t assume that first-party servers from reputable companies are immune to security vulnerabilities. 

    For example, researchers have also uncovered prompt injection vulnerabilities with GitHub’s MCP server and Atlassian’s servers in May and June of this year. There was also a report about Microsoft Copilot still being at risk of prompt injection as well. So, you can’t assume that these servers are all safe.

    Lastly, and most importantly, MCP is a protocol (not a product). And protocols don’t offer a built-in “trust guarantee.” Ultimately, the protocol only describes how servers and clients communicate through a unified language. MCP does not solve authentication and identity management, enterprise operations (e.g., audit trails, observability, compliance) and infrastructure (e.g., hosting, error handling, rate limiting). 

    Organizations are beginning to deploy large numbers of MCP servers internally. What governance blind spots appear when MCP becomes a widespread integration fabric, and can you describe a case where poor governance created operational or security issues?

    Organizations often lack centralized MCP observability and controls, leaving more room for vulnerabilities to emerge outside the purview of security team members. Many organizations don’t even have an internal MCP registry, which is table stakes for setting up processes to approve and govern MCP servers. 

    When companies don’t have processes to approve and monitor MCP servers, shadow MCP and server sprawl both happen. With shadow MCP, employees introduce servers that IT knows nothing about (and wouldn’t approve). IT/security teams also can’t monitor that server’s security in the long run (e.g., if a server starts out fine but becomes vulnerable later on, they’d never know someone internally was using that, even if they became aware of this server having a vulnerability). Server sprawl happens when duplicative, unnecessary, or unused MCP servers create an ever-expanding attack surface.

    MCP gateways allow companies to have an internal registry, which mitigates both shadow MCP and server sprawl. Internal registries make it clear to employees how to get approvals, allowing IT teams to provision tools and provision servers to teams.

    We’ve onboarded a large number of teams that want to create MCP gateways after having poor governance wreck havoc in their organization. I’ve seen security leaders who felt burnt after teams deployed MCP servers locally without sandboxing, or using insecure token storage, access control, and scoping practices. Local MCP servers are especially dangerous, because they may have access to sensitive on-device credentials or files, there could be bearer or API tokens in an MCP.json file (which is concerning because they’re production-access tokens sitting on a machine). So, any vulnerability that can read files could suck those up and send them somewhere nefarious. 

    These are the kinds of issues that security teams either encounter or foresee that causes them to seek an MCP governance solution. Because ultimately, poor governance gives rise to inconsistency of deployment methods, auth processes, and identity management, which can introduce further, wide-ranging risks, and make your MCP ecosystem even more difficult to provision, observe, and fortify.

    As more models gain the ability to call MCP tools, the risk of unauthorized agents or spoofed contexts grows. What steps should organizations take to verify that both the MCP server and the invoking model are authentic, and what protections are still missing from the specification?

    Firstly, organizations should create a review and approval process for adding all MCP clients and servers. This will help protect them from supply chain risks, and it can reduce the likelihood of team members inadvertently introducing malicious clients and servers into the organization. 

    Security conscious organizations should also insist that all MCP servers use OAuth 2.1 with Proof Key for Code Exchange (PKCE) and harden their approach by ensuring that they use regularly rotated, finely-scoped, and securely stored tokens. OAuth is the recommended (but not required) auth flow in the MCP spec because other, more basic auth flows aren’t always time-scoped, which can give access for longer than any IT professional would want. It can be risky to use bearer tokens (instead of OAuth) because they’re often stored in plain text on a machine, which can be used for nefarious purposes if a local MCP server is compromised. 

    Risks can also emerge from the names of tools within MCP servers. If tool names are too similar, the AI model can become confused and select the wrong tool. Malicious actors can exploit this in an attack vector known as Tool Impersonation or Tool Mimicry. The attacker simply adds a tool within their malicious server that tricks the AI into using it instead of a similarly named legitimate tool in another server you use. This can lead to data exfiltration, credential theft, data corruption, and other costly consequences. 

    Implementing and mandating the use of an MCP gateway in your organization provides a solution to most of these risks, as it enables you to:

    • Create and manage your organization’s server and client registry
    • Standardize and ensure the robustness of all MCP auth flows
    • Ensure proper token rotation
    • Create allowlists and blocklists for MCP servers, tools, and clients
    • Add namespaces to tools to assist the AI model in selecting the correct tool
    Where do you think practitioners underestimate the operational effort required to run MCP securely? Is it observability, key management, server hardening, or something else, and what examples have you seen where teams were caught off guard?

    Teams underestimate how much work it takes to implement strong access controls and permission boundaries when using MCP. In addition, the way that most enterprise companies handle identity management and authorization doesn’t always fit into what MCP requires for safe, secure, and scalable deployment. 

    For example, the MCP specification relies upon processes like dynamic client registration (DCR) to register the MCP client with a server. Not all engineers are familiar with DCR because not all auth flows require it. But more importantly, enterprises don’t want anonymized auth flows or shared “service accounts” to access systems, data, applications, and other resources.

    Enterprises we’ve worked with want MCP to plug into their existing identity management infrastructure. They also want real identities attached to both human users and AI agents, along with policies and control. 

    However, implementing even the most basic level of identity and permissions management for MCP servers is a very heavy lift. In addition, there are a lot of flashy (and very dangerous) attack vectors with cool names that get more attention. Identity management, on the other hand, is complex, tricky, and continuously changing, as the capabilities of AI models, use cases for MCP, and the MCP specification itself all evolve. This is why identity management often gets overshadowed and overlooked.

    I’ll sound like a broken record here but that’s where MCP gateways come in. When assessing an MCP gateway, ensure that it offers proper identity management. In addition, you’ll want a gateway that allows teams to provision gateways in such a way that requires each user accessing the gateway to use their own personal credentials for the MCP servers. This prevents the overuse or abuse of shared credentials or “bot” / “service” accounts that may provide too much access and not enough auditability.

    What do you see as the most significant governance challenge as MCP adoption expands across industries, and which emerging best practice do you expect to become standard within the next year?

    Regulatory compliance will become an increasingly important governance challenge as MCP adoption expands across industries and jurisdictions. Using MCP servers creates real risks around data security, protection, and privacy. 

    If organizations don’t have strict, granular access controls and guardrails against sensitive data use and exfiltration, then they will face internal pressure to implement them, along with external pressure. Organizations may need to create or implement measures to comply with near-future legislation that specifically addresses the use of personal data, financial information, health records, and other highly regulated data by AI models. That will include safeguards to prevent data from being accessed by AI or ways to provide auditable logs of AI’s access and actions based on this information.

    I think any security professional who has come into contact with MCP servers and begun to consider the implications for their organization will have concluded that an MCP gateway is a non-negotiable, essential tool they need to deploy, secure, manage, and monitor MCP servers. The best parallel may be how nearly all organizations have robust protections around corporate email, including strong multi-factor authentication requirements, anti-spam, anti-phishing, and audit logs. While you could use email without a platform offering these features, and for many years teams did, it’s an unnecessary risk, and nearly all organizations now use sophisticated email software with these capabilities. MCP governance platforms will become similarly ubiquitous as the ecosystem matures, so it’s just a question of when companies will adopt MCP governance capabilities.

    In terms of other best practices, larger organizations will likely adopt policy-based access controls early on in their MCP adoption. Taking a policy-based approach is a more scalable, secure, and granular way to control access to resources and permissions that fits better with the unpredictable ways that agentic AI uses MCP servers and resources.

    Lastly, many organizations are already deploying MCP servers as internal services, hosted in their own cloud. This shift towards managed MCP deployments will increase, and you’ll see fewer purely local or remote MCP deployments, at least within enterprises.

    Continue Reading

  • Australia’s CS delays gas-fired generator to 2028

    Australia’s CS delays gas-fired generator to 2028

    Australian state-owned utility CS Energy’s gas-fired 400MW Brigalow Peaking Power Plant in Queensland will come on line in late 2028, a year later than originally announced.

    The delay comes as CS has formed a joint venture with Australian gas infrastructure firm APA to fund Brigalow, APA said on 1 December. APA will take a 80pc non-operated stake in the project for which it will building a connection to the gas grid, while CS will control the remaining 20pc and operate the facility.

    Construction of the plant will take three years and will include the installation of 12 gas turbines, with the power plant now set to be commissioned at the end of 2028, a CS spokesperson said.

    The project will cost about A$1bn ($650mn), an analyst with RBC Capital Markets said. The companies expect to complete an engineering design before June 2026, which will determine project costs.

    CS recently announced a gas supply agreement with Australian gas company Senex Energy for up to 58.4PJ (1.56bn m³) over 10 years.

    Queensland’s conservative Liberal National Party government included [A$479mn] (https://direct.argusmedia.com/newsandanalysis/article/2744404) in its 2025-26 state budget for the Brigalow peaking plant.

    This investment is in line with the state’s five-year energy roadmap released in October, which outlines plans to keep coal-fired power plants operational until the late-2030s and mid-2040s and to introduce new gas-fired capacity.

    Queensland’s electricity generation in the last 12 months consisted of 72pc black coal, 11pc solar and a 7pc share each for gas and wind, data from the Australian Energy Market Operator show. The state has the highest percentage of black coal generation in the national energy market, followed by New South Wales’ 68pc.

    Continue Reading

  • Dow Jones Top Markets Headlines at 1 AM ET: Stock Futures Little Changed as Traders Enter December | China …

    Dow Jones Top Markets Headlines at 1 AM ET: Stock Futures Little Changed as Traders Enter December | China …

    Stock Futures Little Changed as Traders Enter December

    Expectations are running high for a strong December after a volatile November.

    —-

    China Private Gauge Signals Weaker Manufacturing Activity

    Growth in China’s manufacturing production came to a halt as new orders nearly stalled last month despite a renewed rise in new orders from abroad.

    —-

    South Korea’s Export Growth Picked Up in November

    South Korea’s exports rose at a stronger-than-expected pace in November, backed by brisk demand for semiconductors and a trade deal between Seoul and Washington.

    —-

    Australia’s Share-Market Operator Suffers Publishing Outage

    Australia’s beleaguered stock exchange operator is investigating an outage that prevented dozens of companies from publishing investor updates at the start of the new trading week.

    —-

    Rate Hikes Wouldn’t Put Brakes on Japan’s Economy, BOJ’s Ueda Says

    The Bank of Japan will thoroughly discuss the possibility of an interest-rate increase at its upcoming meeting, Gov. Kazuo Ueda said, stoking hopes for a resumption of monetary tightening this year.

    —-

    America’s Tariffs Jolted the Global Economy. Its AI Spending Is Helping Save It.

    Economists predicted a global shock from President Trump’s tariffs, but some of them are now revising their global growth predictions upward.

    —-

    American Consumers Have Had It With High Car Prices

    Shoppers are starting to draw the line on what they will pay for a new car, with some turning to used vehicles, taking on longer car loans and holding out for deals.

    —-

    Is America Heading for a Debt Crisis? Look Abroad for Answers

    Politics and debt don’t mix well. Americans would be wise to look across the Atlantic to see how tough things can get.

    —-

    Since Trump’s Return, Bets on His Brand Have Soured

    Stocks and cryptocurrencies tied to the president and his family have tumbled amid a broader rout of riskier assets.

    —-

    A Chicago Data Center Overheated-and Shut Down Trade in Key Markets Across the Globe

    The outage, which lasted for 10 hours, hit CME’s equity, bond and commodity futures. It also offered a warning.

    —-

    Week Ahead for FX, Bonds: U.S. ISM, ADP Data in Focus as Fed Rate Cut Looks Likely

    U.S. ISM surveys on manufacturing and services activity, plus the latest ADP private payrolls, will be watched closely for confirmation that the Federal Reserve could cut interest rates at its next meeting.

    —-

    Canadian Economy Rebounds by More Than Expected

    Canada’s economy recovered far more strongly than anticipated in the latest quarter, pulled out of its decline by a bounce-back in net trade and a surge in defense spending that helped mask weak domestic demand.

    —-

    The Fed Is Turning the Corner on Profits. It’s Good for the Treasury.

    Higher interest rates have brought a tide of red ink to the bank.

    (END) Dow Jones Newswires

    December 01, 2025 01:15 ET (06:15 GMT)

    Copyright (c) 2025 Dow Jones & Company, Inc.

    Continue Reading