Floppy discs, vague tickets, and phishing training. It’s the IT news and research round up.

Picture this. You’re wandering the collections of the majestic Cambridge University Library, which “probably began life in the fourteenth century as a collection of manuscripts stored in chests.” You pause to admire a Sumerian clay tablet; its six lines of cuneiform are the oldest bits of writing in the institution’s safekeeping (2200 BC). Further on, you’re awestruck by a first edition of Isaac Netwon’s seminal Principia, its margins filled with the polymath’s handwritten annotations (1669 AD).

As you make your way to the room that houses the library’s own Gutenberg Bible (~1455 AD), you encounter a crowd forming around a mysterious object. Whatever this new acquisition is, it’s causing quite a stir! Your curiosity is almost unbearable as you approach, until you finally set eyes on what reveals itself to be…a floppy disk (1971 AD)?

Read on to learn why Cambridge library technicians care so much about the humble floppy. But first, a handful of fascinating IT news and research items from around the web.

How to handle vague and incomplete support tickets (SpiceWorks)

Vague tickets like “It’s broken” cost time and morale. Leadership should reward well-formed tickets and model clarity. Profiling users, such as “busy” employees or technophobes, can help IT teams create tailored solutions like structured forms with mandatory fields or micro-learning guides. Tracking ticket quality as a KPI (currently done by only ~25% of orgs), enforcing attachments, and real-time feedback reduce resolution times and SLA breaches, transforming support into a proactive, efficiency-driven operation.

Key quote:

“A vague ticket problem is rarely an individual problem. It’s a cultural one that festers when IT is seen merely as a reactive service instead of a collaborative partner. The tone you set at the top—the CIO, the VP of Technology, the service desk manager—determines whether people treat IT like a vending machine or a trusted consultancy.”

Exposure Report: 65% of Leading AI Companies Found with Verified Secret Leaks (Wiz)

New research from Wiz found that 65% of leading AI companies exposed sensitive credentials on GitHub, including API keys and tokens granting access to private models. One breach revealed access to over 1,000 models. Despite a combined valuation of $400 billion, nearly half failed to act on breach alerts. Essential defenses include mandatory secret scanning before commits, depth scanning of forks and deleted repos, incident response protocols, and developer training in secure DevSecOps practices.

Key quote:

“Secrets leakage has often been described as an iceberg: a set of known risks exposed publicly in GitHhub organizations, but also a deeper risk below the surface in commit history, deleted forks, workflow logs etc.”

Understanding the Efficacy of Phishing Training in Practice (2025 IEEE Symposium on Security and Privacy)

A randomized study of over 19,500 healthcare employees found that annual cybersecurity training and embedded phishing simulations provided minimal real-world benefit. No significant link was found between recent training and reduced phishing failures, and embedded training lowered failure rates by just 1.7%. More than half of users ended training sessions within 10 seconds, and less than a quarter of users complete the assigned materials.

Key quote:

“Moreover, we observe that all of these groups still have failure rates of over 15 % for several phishing simulations, and that some phishing lures achieve over 25% click rates. Such failure rates significantly overshadow the improvements provided by the training: better phishing lures increase failure rates much more than the training approaches decrease them.”