eCommerce 0day: Magento users compromised at scale
Rust binary shows aggressive persistence efforts.
Rust binary shows aggressive persistence efforts.
Bank of America Chief Information and Technology Officer (CTIO) Hari Gopalkrishnan has played a key role in the bank’s AI rollout since it first announced its Erica chatbot back in 2016, but, speaking to The Stack, he strikes a cautious tone when discussing the returns on AI investment.
“People are going a little crazy about, like, ‘We can use agents, and agents will call agents, and they will use tokens,’” he says during a conversation at the bank’s London office, “Before you know it, something that was a $100,000 process, you spend $1 million trying to optimize it.”
That’s not to say America’s second-largest bank, which manages some $4.9 trillion in client funds, isn’t investing heavily in AI.
After chatting with The Stack, the CTIO team sent over AI statistics outlining its 300 use cases in development, 34 of which are “fully deployed,” and 1,722 AI-focused patents registered in its name.
But Gopalkrishnan says it's easy to fall into a trap with AI, explaining, “With old technologies, you spent so much time writing code, you had plenty of time to figure out how much it was going to cost you. Because [AI] is so fast to deploy, it's very easy to get seduced into thinking ‘Let's just go full steam ahead and figure out the cost later.’”
“That doesn’t work well,” he adds.
The Stack is resurfacing some of our favourite "Big Interviews' from 2025 as we close off the year. This piece first appeared on August 26.
BNY CIO Leigh-Ann Russell’s first job after school was in a bank. She hated it: “I had to stamp cheques every day; thousands of them. I’d get to 1,500 stamps, and then I'd forget the number, and I have to start it all again. It just wasn't my dream of how I would spend my life” she tells The Stack.
Russell grew up in a council estate in Scotland. Her dad worked a manual role during the week, and at a fish-and-chip shop at the weekends. To them, an apprenticeship in a bank sounded like white collar stability. So when she decided to go to university – the first in her family to do so – to study engineering, they were worried and taken aback, she recalls.
“I think my mom said, ‘but universities are for hippies and rich people,” she remembers with a wry laugh. But intent on blazing her own trail, she set off to Aberdeen University for a degree in engineering that changed everything. She’s now back in a bank as CIO, and this time, she’s loving it.
Leigh-Ann Russell is now Chief Information Officer of BNY, a bank that oversees $51 trillion in assets for clients and which in recent years has embarked on a major technology and organisational transformation.
BNY was created by founding father Alexander Hamilton in 1784 and became the first firm listed on the New York Stock Exchange.
“Legacy”? Just a bit, then! Whilst much of it is proud “legacy”, the bank, like every well-established financial services firm, had no shortage of ageing infrastructure and applications to clean up. Mercifully, a major overhaul had already born fruit when Russell joined in 2024, she cheerfully admits.
“We had a greenfield project which was really about massively upgrading our infrastructure and our app environment. A lot of that core work had been completed. We're 35% more energy efficient in our data centers. We're 40% more space efficient in our data centers…” she explains.
The cloud/on-prem split is “roughly a third of our apps sit in the cloud environment, but almost our entire landscape is cloud-ready, so that we can move from on prem to cloud at will as we choose what's right for the right application…” she adds in response to a question from The Stack.
(A few recently closed roles in BNY’s technology services group arguably give a flavour of the shift. One VP role captures a whole industry zeitgeist, seeking expertise “creating, configuring, upgrading and administering Kubernetes clusters on VMs/BareMetal… OpenShift experience is a plus… Must have experience in ArgoCD or Flux, Helm/Kustomize, Prometheus based monitoring, Ansible, Terraform and CI/CD automation”; every organisation's "digital transformation" Ted talk in a single job description!)

This modernisation effort has taken place under the leadership of Goldman Sachs veteran Robin Vince, who took over as CEO in September 2022. (Prior to the CEO role he ran the bank’s clearance and collateral management, treasury services, markets and execution services.)
BNY has been notably building out its bench under his leadership. (It also recently added Blackrock’s Carolyn Weinberg as Chief Product and Innovation Officer. Like Russell, she sits on the Executive Committee.)
“Many people across our organization are focused on innovating new capabilities, instant payments, digital assets, wealth tech, private markets, collateral, liquidity, all examples of domains where we are innovating” CEO Vince emphasised on BNY’s Q1 earnings call in April. (Weinberg will focus on “innovative new commercial opportunities and find new ways to leverage our platforms and data for client solutions…” he said on the call.)
On the organisational front, Vince warned that BNY was intent on making sure that it does not “repeat the problems we’ve had in the past of having everyone go off in their own direction” – resulting in siloed capabilities and platform engineers wrestling with an untidy plethora of systems.
He’s instated a platform model with group-wide functions like payments, data, treasury etc. for more horizontal innovation and simplified stacks. A quarter of employees had transitioned into the model by end-2024. BNY expects that figure to hit 80% by the end of calendar 2025, earnings show.

BNY is keen to innovate hard with AI across those platforms, making use of its extensive datasets, and that’s one of Russell’s priorities, she says.
The idea was to aggressively democratise AI access and see what started bearing fruit when everyone got AI seeds to sow. Before that happened, the bank rolled out a group-wide AI training programme.
Some of the very first to take it were lawyers: “Our legal function [is] at 100% training completion. They have gone out [of the way] to make themselves innovative. So when they work with us on, ‘how do we keep our data safe?’ ‘How do we ensure privacy?’, every single one of our lawyers… understands what we're trying to do, and they're not blockers," she explains.
“They keep us completely within our guardrails – same with risk, same with our cyber teams – but because they've all been part of the immersion they've become real advocates and champions [for AI]. Our mantra was ‘AI for everyone, everywhere,” Russell tells The Stack. Why? "Because the best ideas don't all come from the engineering department. They come from the folks in the business who think ‘now I understand what AI is, this is how I can apply it to make things better at the bank.’
There’s an endless tidal wave of AI noise in the market and so much froth versus what is arguably just the lightest mist when it comes to ROI still.
But Russell, engineer’s hat firmly on, is a genuine convert – taking the conversation offline too after the interview – and pushes back on this characterisation: “We have more than 40 AI solutions in full production.
“They touch almost everything at the bank” she says on production deployments, citing “anomaly detection on our asset servicing platforms, trade settlements; on our Client Services team, we have a multi-agentic solution; these are delivering real value in dollar terms and productivity terms. I would say that scale [of deployment] is pretty unique…”
Pushed on the tracking of ROI she’s quick to respond and her view is arguably counterintuitive: “I think many organizations that I talk to get really stuck on ‘oh, I can't put this into production till I narrow what the exact dollar value is, or that exact productivity value has been!’”
Not trying to track and micro-manage each deployment, now the training is done and group-wide guardrails are set “has truly been part of our success…” Russell says, also highlighting the bank’s “Eliza” chatbot and new partnership with OpenAI (it also uses other models), although the bank also cites how its digital transformation has helped drive down unit costs, for example helping deliver ~5% lower cost per custody trade, ~15% lower cost per net asset value in traditional fund services versus last year.
On genAI “we have 85% of the bank fully trained. And 8,000 of those people – bear in mind, we're a 50,000 person bank – are building their own agents” flags Russell. That’s the result of “massive team sport between legal, our risk function, our cyber teams, our AI hub; we have set up model governance that I also think [represents] real innovation.”
Where, as a Chief Information Officer, does she sit in BNY particularly vis-a-vis this new platform model, we ask? Russell, who reports to the CEO, briefly sketches out the platform approach again and explains that “engineering sits as a matrix on that… I have an entire engineering organization who matrix into me, but also report directly into the platforms,” adding “I think that's a wonderful model, if you do it correctly.
“How do you get the engineers to rally around a problem in the platforms world, but still report back into the engineering function for their careers, for their developer productivity experience, for the standards by which we operate engineering? I think that's a real sweet spot. Organize around a problem, but make sure you don't lose control of your standards and career paths by having an overlay of the engineering function.”
That’s an approach she was an advocate for at her previous employer BP, she says – where she ran $30 billion in annual supplier spend as Chief Procurement Officer, before taking on the CTO role; an unusual shift.
What did she take from that procurement role on the technology side, we ask? “I took a lot from that role. One thing about a procurement organization is it's come deeply commercial, deeply technical and deeply about partnering organisations,” Russell recalls. “I [also] honed quite a lot of my technology skills in procurement, because it's really critical to have frictionless supply chains. So that could be right at the front-end of using digital auctions… to process automation. There was a whole bunch of technology that goes with the supply chain that I found really enjoyable.
“I think the partnership bonus was the most critical [lesson]. [I learned early on that] you work better in a partnership than you do in a traditional supplier relationship, because you understand what your client is trying to do better, and you'll go the extra mile to help them do that.
“If you know the type of environment you're trying to play into, you can standardize your own products, make your own business better… get into that real win-win for both organizations” she adds. “Nobody's successful without great partnerships. That is a real focus for me in engineering.”
She adds that “we don't have an enormous [technology] organization compared to some of the other banks. So we have to be very thoughtful about where our engineering time is spent: that is generally on products that are completely innovative… in the competitive sphere of banking.”
But BNY also has a team called the “spin team” that goes out and scans the startup horizon: “We not only take some stakes in companies to help them as they're growing; we also have a development program where we bring in really early-stage startups and help them develop their product.”
She concludes: “[That] is probably more important to them in the tech space than funding at the moment: because people love investing in tech; they love investing in AI. But giving folks money isn't the end of the story. If you're a small startup, coming in, having access to our engineers, having access to our business people… having access to our cyber teams to build great products… [that] has been a really key part [of our success].”
There’s too much to talk about and not enough time.
We’ve barely touched on the ultra-running hobby (“I didn't start running until much later in life. It was probably in my late 30s, when I first just went out for a random run. I had a couple of rescue dogs, and I thought, ‘why not do this?’ It was a bit of a Forrest Gump thing. And then I just kept going…” or the yoga teacher training. (“I lived in the UK at the time. We had a very nice village, but yoga classes were about £30 pounds per class, which is just not accessible, and I loved the whole mental balance of yoga, so I became a yoga teacher and taught for free in my community…”)
But some final thoughts on an extraordinary career that has taken her from council estate to oil rigs, billions in procurement spend management to senior technology leadership roles; much of it juggling life as a single mum. What does she think she brings to the role as a CIO as a result?
She pauses: “When I was in my early stages trying to make it as a young female engineer [harnessing the best out of people was not something I was always] great at. But then as I matured into leadership positions, I really found that niche around ‘how do I find the best people?’ ‘How do I help them be the best versions of themselves?’ And I think that's really transferable, whether you work in any sector, or whether you have a pure computer science background or you're an engineer. I think that ability to get the best out of people is what leadership is really all about.”
Running cybersecurity for the world’s most successful military alliance is not for the faint hearted; there’s a target on NATO’s back and powerful adversaries are sniping at it. Mario Beccia stays focused through martial arts, music, and spending time with family.
Mental clarity is vital: He’s grappling with a set of challenges familiar to many enterprise CISOs, as his teams battle to keep NATO’s enterprise technology systems secure. Balancing innovation with security, modernising identity management and cryptography across a complex landscape, and communicating complex technical issues upstream to multiple stakeholders; many of whom are well-versed in kinetic conflict, but less so in its digital counterpart.
Mario is NATO’s Cyber Readiness and Operations Director, Cyber and Digital Transformation Division; a long title that also comes with a long list of hard-won responsibilities. (It’s arguably simpler to think in four letters: Over the past five years the Italian national has been working as Deputy CIO, Cybersecurity; effectively holding a CISO role for NATO’s enterprise IT systems, which serve some 30,000 alliance users.) He joined The Stack to talk us through his main pain points and priorities.
It has been nine years since NATO recognised cybersecurity as a domain of operations; far fewer since it started trying to bring some central coordination to its own cybersecurity and broader IT functions. (In 2021, for example, the multinational defence alliance hired its first CIO, with a mandate to deliver “coherence” across its 57 civil and military bodies.)
It is now restructuring how it delivers technology modernisation, and critically, supports cybersecurity – including via a new NATO Integrated Cyber Defence Centre (NICC) that its leaders announced in 2024.
Beccia, an experienced enterprise architect rejoined NATO in early 2021, after three years as CISO of the European Defence Agency (EDA), where he helped build out a greenfield cybersecurity practice at the agency. (At NATO he has previously managed a range of key cybersecurity programs and enterprise architecture initiatives, including at NATO Communications and Information Agency and NATO Allied Command Transformation.)
Sitting down to chat with The Stack in Brussels, he’s happy to reflect on some of the hard-won successes of the past four years, including efforts to dramatically streamline technology procurement, but is also candid on the challenges that remain, as the alliance continues to prioritise more joined-up thinking among its members.
Goldman Sachs’ CIO Marco Argenti doesn’t describe himself as Chief Information Officer on LinkedIn (where he is “Engineer” instead), and despite being a partner at the investment bank and member of the management committee, gives the impression that he is ready to roll up his sleeves and start coding alongside Goldman’s 12,000+ technologists.
Maybe it’s a childhood spent tinkering with an HP-41 programmable calculator – “I built my first computer programme on an actual computer when I was 13; that was a very long time ago, by the way” he says drily – but sitting down to talk with The Stack in Goldman Sachs’ New York offices, Argenti still clearly retains a genuine enthusiasm for testing the capabilities of emerging technologies; including, yes, generative AI.