<h2>Key Takeaways</h2>
<ul>
<li>Klarna&#8217;s AI customer service story is really two announcements eighteen months apart, and a UK C-suite should read both, not just the first one that went viral. In February 2024, Klarna said its OpenAI-built assistant handled 2.3 million conversations in its first month, doing the equivalent work of 700 full-time agents, cutting resolution time from 11 minutes to under 2, and was projected to add $40 million to 2024 profit.</li>
<li>By May 2025, chief executive Sebastian Siemiatkowski told Bloomberg the strategy had gone too far. &#8220;We focused too much on efficiency and cost,&#8221; he said. &#8220;The result was lower quality, and that&#8217;s not sustainable.&#8221; Klarna started recruiting human customer service agents again, on flexible, remote, gig-style contracts.</li>
<li>The headcount numbers are genuinely mixed, and worth reading precisely rather than as a clean before-and-after. Klarna&#8217;s workforce fell from roughly 5,000 to almost 3,000 employees, about 40%, but Siemiatkowski himself credited much of that to ordinary staff attrition, which he put at 15 to 20% a year, not to the AI system directly replacing people.</li>
<li>The AI didn&#8217;t get switched off. As of the May 2025 reversal, it was still handling two-thirds of all customer inquiries, response times were 82% faster than before the AI launched, and repeat contact rates were still down 25%. What changed was where the company drew the line between what AI should handle and what a person should.</li>
<li>Klarna reversed its AI-first messaging five months before pricing a $1.37 billion IPO on the New York Stock Exchange in September 2025 at a $15.11 billion valuation, itself a steep comedown from the more than $45 billion the company was valued at in 2021. For a UK C-suite, the lesson isn&#8217;t that Klarna&#8217;s AI failed. It&#8217;s that a cost-driven AI rollout and a customer-quality AI rollout are different projects with different failure modes, and Klarna ran the first one before realising it needed the second.</li>
</ul>
<p>Klarna&#8217;s AI customer service assistant is the most cited AI case study in enterprise circles for a reason: it is one of the few with a genuinely public, multi-year arc, a triumphant launch, a candid reversal, and enough concrete numbers at each stage to actually compare. Most AI case studies a UK C-suite reads are either brand-new and unproven or old enough that no one is still checking the follow-up. Klarna&#8217;s is neither. It has been checked, restated and partly walked back by its own chief executive, on the record, twice.</p>
<h2>What Klarna actually announced in February 2024</h2>
<p>Klarna&#8217;s AI assistant, built in partnership with OpenAI, went live globally in Klarna&#8217;s app in February 2024. In a press release dated 27 February 2024, Klarna said the assistant had handled 2.3 million conversations in its first month, two-thirds of Klarna&#8217;s total customer service chat volume, work the company said was equivalent to that of 700 full-time human agents.</p>
<p>Average resolution time fell from 11 minutes to under 2, and repeat customer inquiries, people re-contacting support because their issue hadn&#8217;t actually been resolved, dropped 25%.</p>
<p>Klarna said the assistant was on par with human agents on customer satisfaction scores, available around the clock in 23 markets, and could communicate in more than 35 languages. The company estimated the assistant would drive a $40 million improvement to 2024 profit. &#8220;This AI breakthrough in customer interaction means superior experiences for our customers at better prices,&#8221; said Sebastian Siemiatkowski, Klarna&#8217;s co-founder and chief executive, in the announcement.</p>
<p>OpenAI&#8217;s own chief operating officer, Brad Lightcap, called Klarna &#8220;at the very forefront among our partners in AI adoption and practical application.&#8221;</p>
<h2>The hiring freeze nobody outside the company saw happen in real time</h2>
<p>What followed the launch wasn&#8217;t publicised with the same fanfare. In a Bloomberg Television interview reported in December 2024, Siemiatkowski said Klarna had effectively stopped hiring around a year earlier as the AI system took on more of the workload, with headcount falling 22%, to roughly 3,500 employees, over that period, driven mostly by natural attrition rather than layoffs.</p>
<p>That framing matters: Klarna didn&#8217;t announce mass redundancies tied to the AI launch. It quietly stopped backfilling roles as people left, and let the AI system absorb the resulting gap in customer service capacity.</p>
<h2>May 2025: the reversal, in Siemiatkowski&#8217;s own words</h2>
<p>By May 2025, in another Bloomberg interview reported by trade publication CX Dive and others, Siemiatkowski said the strategy had gone further than it should have. &#8220;We focused too much on efficiency and cost,&#8221; he said. &#8220;The result was lower quality, and that&#8217;s not sustainable.&#8221; He was specific about what he thought the company had got wrong: not that AI itself was the mistake, but that Klarna had let cost-cutting outrun the customer experience it owed people who needed genuinely human help. &#8220;I just think it&#8217;s so critical that you are clear to your customer that there will always be a human if you want,&#8221; he told Bloomberg, adding, &#8220;Really investing in the quality of the human support is the way of the future for us.&#8221; Klarna began recruiting customer service staff again, piloting what CX Dive described as an &#8220;Uber-type&#8221; flexible, remote, gig-style arrangement aimed at &#8220;highly educated students, professionals and entrepreneurs&#8221;, with one stated goal being to bring in-house some of the customer service work Klarna had previously outsourced to third-party contractors, rather than simply re-hiring for the original 700 roles the AI had absorbed.</p>
<p>Separately, in a CNBC interview around the same time, Siemiatkowski gave the fuller headcount picture: Klarna&#8217;s total workforce had fallen from about 5,000 to almost 3,000 employees, a roughly 40% reduction.</p>
<p>But he was careful not to credit all of that to the AI system directly. &#8220;Natural attrition in a company like ours is 15-20% per year, so we shrink naturally 15-20% by people just leaving,&#8221; he said, framing the AI&#8217;s role as enabling the company to not backfill those departures rather than actively cutting jobs itself.</p>
<p>That distinction, between AI-enabled attrition and AI-driven layoffs, is one most retellings of the Klarna story flatten, and it&#8217;s a materially different claim about what the technology actually did.</p>
<h2>The AI didn&#8217;t get switched off. The target changed.</h2>
<p>The detail most useful to a UK C-suite is what didn&#8217;t change in May 2025: the AI assistant was still handling roughly two-thirds of all customer inquiries even after Siemiatkowski&#8217;s public reversal, CX Dive reported, with response times still 82% faster than before the assistant launched and repeat contact rates still down 25%. Klarna didn&#8217;t retreat from AI-handled customer service as a category.</p>
<p>It retreated from treating &#8220;AI handles it&#8221; as sufficient for every kind of interaction, and rebuilt a deliberate lane for cases, complex disputes, financial hardship, anything where getting it wrong costs a customer real money or trust, that get routed to a person instead of resolved end-to-end by the assistant.</p>
<p>The rollout&#8217;s actual failure mode wasn&#8217;t that the AI performed badly against the metrics Klarna originally chose to measure. It was that those metrics, speed and average satisfaction, didn&#8217;t capture whether harder, lower-volume, higher-stakes cases were being handled well.</p>
<h2>The timing a UK C-suite shouldn&#8217;t miss</h2>
<p>Context that rarely makes it into the Klarna story: the May 2025 reversal came five months before Klarna priced its US initial public offering. Klarna listed on the New York Stock Exchange under the ticker KLAR in September 2025, pricing shares at $40 and raising $1.37 billion at a $15.11 billion valuation, a real recovery from the roughly $6.7 billion trough Klarna&#8217;s valuation fell to in 2022, but still a steep comedown from the more than $45 billion it commanded at its 2021 peak.</p>
<p>A company preparing to go public in 2025, after a valuation collapse, had every commercial incentive to tell an aggressive cost-efficiency story through 2024, and then to be seen correcting course on customer quality before investors started asking pointed questions about churn and brand damage.</p>
<p>None of that makes Siemiatkowski&#8217;s admission untrue. It&#8217;s a reasonable, evidence-based reading of why the timing looked the way it did.</p>
<h2>What a UK C-suite should actually take from this</h2>
<p>Klarna&#8217;s AI assistant did what Klarna said it did in February 2024: handled millions of routine conversations faster and, on the metrics Klarna chose to track, at least as well as the humans it replaced.</p>
<p>That part of the story holds up. What failed wasn&#8217;t the AI&#8217;s competence at the task it was measured against; it was the decision to let a cost and efficiency target stand in for a customer-quality target, and to let that substitution run for the better part of a year, through a hiring freeze and a real headcount reduction, before correcting it in public.</p>
<p>For a board weighing its own AI-driven customer service plans, the specific, transferable lesson isn&#8217;t &#8220;AI customer service doesn&#8217;t work,&#8221; which the two-thirds figure that survived the reversal directly contradicts.</p>
<p>It&#8217;s that the metrics chosen to declare an AI rollout a success will determine what gets missed, and that a board should decide, before launch, which failure it would rather catch early: a bad quarter of efficiency numbers, or a public reversal after a year of customers quietly getting worse service than they were promised.</p>


Klarna Cut 700 Jobs’ Worth of Work With AI. Its CEO Now Says That Was the Mistake

<h2>Key Takeaways</h2>
<ul>
<li>Twelve AI deployments published on this site reduce to three real categories: internal knowledge retrieval, customer- or citizen-facing communication, and narrower plain-language interfaces over an existing system.</li>
<li>The largest, most specific results came from the narrowest, most rules-based tasks, such as Amey&#8217;s bid-writing time falling from four days to 30 minutes.</li>
<li>Four of the twelve, moinAI, contexxt.ai, Yepic.AI and Policy-Insider.AI, all run on OVHcloud infrastructure specifically for GDPR and European data-sovereignty reasons.</li>
<li>Jaguar Land Rover&#8217;s case study describes a roadmap and a secured business case rather than a finished, measured deployment, unlike the other eleven.</li>
<li>Across the set, the size and specificity of a reported result tracks how narrow and well-bounded the automated task was, not how ambitious the AI project sounded.</li>
</ul>
<h2>TLDR</h2>
<ul>
<li>Twelve AI deployments published on this site, spanning automotive engineering, water utilities, infrastructure services, legal tech, aged care, local government, customer chat, enterprise knowledge search, generative video and public-affairs monitoring, describe a narrower range of actual mechanisms than the industry variety suggests. Most are built to solve one of two problems: finding information that already existed but was too slow to locate, or communicating with a customer or citizen faster than a human team could manage alone.</li>
<li>The clearest, most repeatedly measured successes cluster around document-heavy, rules-based tasks. Amey&#8217;s bid-writing platform cut drafting time from four days to 30 minutes; an unnamed Dynamiq legal client cut contract review from 1.5 hours to 45 minutes; Anglian Water cut manual governance effort by up to 6,000 hours a year. In each case, the AI was retrieving and structuring information a human already had the standing to evaluate, not making a new judgement call.</li>
<li>A distinct European vendor cluster runs through four of the twelve deployments, moinAI, contexxt.ai, Yepic.AI and Policy-Insider.AI, all built on OVHcloud infrastructure specifically because of GDPR and data-sovereignty requirements their customers demanded. None of the four cite performance or cost as the primary reason for that infrastructure choice; all four cite European hosting as close to non-negotiable.</li>
<li>Not every case study reports a completed, measured result. Jaguar Land Rover&#8217;s engagement describes a roadmap and a secured business case, not a deployed tool with a time saving attached, a genuinely different, earlier stage of the same underlying problem the other eleven case studies describe as finished.</li>
<li>For a UK C-suite, the practical value of reading these twelve together isn&#8217;t a list of AI success stories to imitate individually. It&#8217;s the pattern underneath them: the deployments with the clearest, most defensible results all automated a narrow, well-bounded, previously manual task, and the ones with the vaguest results were the ones asked to do more than that.</li>
</ul>
<p>Twelve AI case studies published on this site look, on the surface, like twelve unrelated stories about twelve unrelated organisations. Read together, in their own words, they describe a much smaller number of actual problems being solved, and a genuinely useful pattern in which of those problems produced results specific enough to trust.</p>
<h2>Twelve deployments, and what each one was actually built to do</h2>
<p>At <a rel="nofollow" href="https://www.networksjournal.com/content/jaguar-land-rover-ai-investment-roadmap-engineering">Jaguar Land Rover</a>, the problem was strategic rather than operational: building a business case for a new, data-driven engineering operating model and prioritising which AI use cases were worth pursuing across a 16,000-strong engineering workforce. Aiimi applied its AI Strategy Framework to build a roadmap measured against impact, feasibility, affordability and enterprise alignment, and separately extended Enterprise Search over JLR&#8217;s product engineering documentation. &#8220;They helped us show where data and AI could make a real difference to engineering, aligning that to business value and shaping an AI roadmap that builds momentum quickly,&#8221; said Dave Hird, JLR&#8217;s Head of Data Driven Engineering &#038; AI.</p>
<p><a rel="nofollow" href="https://www.networksjournal.com/content/anglian-water-asset-document-governance-automation">Anglian Water</a> solved a related but more advanced version of the same problem. Asset and site documentation was scattered across physical &#8220;blue boxes,&#8221; shared drives and specialist applications; manual audits consumed up to 17,000 hours per cycle, and inspectors repeatedly flagged document control issues because field teams couldn&#8217;t reliably find current information on site. Aiimi&#8217;s Virtual Blue Box automatically classifies and tags documents across all 7,000 of the utility&#8217;s sites, running continuous compliance checks. &#8220;By harnessing the capabilities of Machine Learning and Natural Language Processing, it addresses critical challenges faced by technicians in having access to the most relevant and latest information when they&#8217;re on-site and need it most,&#8221; said Stuart Rawdon, Anglian Water&#8217;s Enterprise Content Governance Manager.</p>
<p><a rel="nofollow" href="https://www.networksjournal.com/content/amey-generative-ai-knowledge-platform-bid-writing">Amey</a> had &#8220;decades of asset management expertise&#8221; locked inside individual silos rather than something anyone could quickly search, according to this publication&#8217;s own account. FOIL built Gennie, a generative AI knowledge platform integrated into Amey&#8217;s Microsoft ecosystem. &#8220;We have this vast, deep experience of how we manage assets for our clients. What if you could bring together all of that knowledge and make it searchable and instantaneous?&#8221; said Rob Curley, Amey&#8217;s Project Director.</p>
<p>An unnamed client of <a rel="nofollow" href="https://www.networksjournal.com/content/dynamiq-ai-legal-agent-contract-review">Dynamiq</a> faced the same shape of problem inside a legal department: reviewing thousands of contracts and regulatory documents on tight timelines while relying on costly outside counsel to fill the gaps. Dynamiq built an AI legal agent on the IBM watsonx platform. &#8220;IBM watsonx.data provides a very robust platform for integrating and embedding proprietary client data for AI agents,&#8221; said Vitalii Duk, Dynamiq&#8217;s founder and chief executive.</p>
<p>At <a rel="nofollow" href="https://www.networksjournal.com/content/regis-aged-care-generative-ai-clinical-handover">Regis Aged Care</a>, Australia&#8217;s largest residential aged care provider, clinicians spent two to three hours per shift reviewing more than 200 pages of clinical notes during handovers. Cognizant built a generative AI assistant on Microsoft Copilot Studio, benchmarked against senior clinician standards throughout development. &#8220;Be ambitious about the question you want answered. Don&#8217;t limit yourself in terms of what you think is possible,&#8221; said Imtiaz Bhayat, Regis Aged Care&#8217;s Chief Information Officer.</p>
<p><a rel="nofollow" href="https://www.networksjournal.com/content/ferndown-town-council-decisions-ai-meetings">Ferndown Town Council</a> moved the same underlying idea into local government: a Clerk previously managing agenda preparation and action tracking entirely by hand adopted GovMeetings, a platform powered by Decisions AI. &#8220;Decisions AI has completely reshaped how we run our meetings. It&#8217;s efficient, professional, and intuitive,&#8221; said Liz Bishopp, the council&#8217;s Clerk.</p>
<p>The remaining six deployments move away from internal knowledge retrieval into customer- and citizen-facing communication, and generative content. <a rel="nofollow" href="https://www.networksjournal.com/content/moinai-secures-german-health-insurer-chats-with-eu-based-managed-databases">moinAI</a>, a Hamburg-founded chatbot company serving more than 100 German customers including major insurers, processes several million customer interactions a year. &#8220;Our customers, particularly in the German health sector and SMEs, require the strictest data protection and security standards, and prefer a provider based in Germany or Europe,&#8221; said Florian Nommensen, moinAI&#8217;s Managing Director and CTO.</p>
<p><a rel="nofollow" href="https://www.networksjournal.com/content/contexxt-ai-generative-ai-knowledge-platform">contexxt.ai</a>, a DeepTech startup founded within an academic setting in 2023, built its Sesame platform on a zero-knowledge architecture so that neither it nor its cloud provider can access customer data being processed. &#8220;Research shows we spend up to two hours a day searching for information. Sesame gives that time back,&#8221; said founder and chief executive Torsten Katthöfer.</p>
<p><a rel="nofollow" href="https://www.networksjournal.com/content/yepic-ai-generates-1-million-videos-on-high-end-gpu-cloud-instances">Yepic.AI</a> builds generative AI video and voice translation technology. &#8220;Twenty-five million Americans don&#8217;t speak English, and in the UK nearly 1 million people can&#8217;t speak English well enough to access healthcare without an interpreter,&#8221; said Aaron Jones, the company&#8217;s CEO, framing the tool as an access problem rather than a productivity one.</p>
<p><a rel="nofollow" href="https://www.networksjournal.com/content/policy-insider-ai-processes-5000-daily-policy-documents-on-gdpr-compliant-public-cloud">Policy-Insider.AI</a> processes around 5,000 new political documents a day across more than 40 institutions and 8,000 daily social media posts from over 4,000 policymakers, replacing manual monitoring of public policy across languages and borders. &#8220;The availability of powerful CPU and latest GPU architectures&#8230; is crucial to our platform effectively handling AI workloads,&#8221; said Agata Chudzinska, the company&#8217;s co-founder and Head of AI.</p>
<p><a rel="nofollow" href="https://www.networksjournal.com/content/velotix-ai-assistant-development-time-compliance">Velotix</a> embedded a conversational assistant into its data access platform so users could manage compliance policy in plain language rather than through specialist tooling. &#8220;With AI supporting natural language queries, we give users the freedom to stay focused on their work, while intelligent policy enforcement runs silently in the background,&#8221; said Yoram Segal, the company&#8217;s Chief Technology Officer and Chief AI Officer.</p>
<p>And at <a rel="nofollow" href="https://www.networksjournal.com/content/akzonobel-corporate-event-app-guest-communication">AkzoNobel</a>, the problem was smaller in scale but familiar in shape: fragmented guest communication at corporate events, information scattered across emails and PDFs. QuantumXL built an AI-powered guest app. &#8220;They really listened to the brief and delivered above and beyond,&#8221; said Tina Waller, AkzoNobel&#8217;s Events Manager.</p>
<h2>Comparisons of the projects</h2>
<p>Laid side by side, these twelve deployments split cleanly into three categories rather than twelve unique stories. Six, Jaguar Land Rover, Anglian Water, Amey, Dynamiq&#8217;s client, Regis Aged Care and Ferndown Town Council, are internal knowledge-retrieval tools: AI built to find, summarise or structure information a human employee already had standing to use, just not quickly. Four, moinAI, contexxt.ai, Yepic.AI and Policy-Insider.AI, are customer- or public-facing communication and content tools, chat, translation, video and document monitoring, aimed outward rather than at internal process. Velotix and AkzoNobel sit closer to the first group in mechanism, plain-language interfaces over an existing system, but serve narrower, more specific functions, data compliance and event logistics respectively, than the broader knowledge-retrieval cluster.</p>
<p>A distinct vendor pattern runs through the outward-facing cluster specifically: moinAI, contexxt.ai, Yepic.AI and Policy-Insider.AI are all built on OVHcloud infrastructure, and all four cite the same reason, GDPR compliance and European data sovereignty, rather than raw performance or cost, as the deciding factor. contexxt.ai&#8217;s Torsten Katthöfer put it most directly: &#8220;We were looking for a partner that thinks and acts with an European mindset.&#8221; That&#8217;s a genuinely different kind of infrastructure decision than the internal-tooling cluster made: Dynamiq&#8217;s client and Velotix both chose IBM&#8217;s watsonx platform specifically for enterprise integration and on-premises deployment flexibility for regulated finance and healthcare clients, while Aiimi&#8217;s two clients, Jaguar Land Rover and Anglian Water, and FOIL&#8217;s client, Amey, chose their vendors for domain-specific knowledge architecture rather than infrastructure sovereignty at all.</p>
<p>The clearest outlier among the twelve is Jaguar Land Rover, and it&#8217;s worth reading as a genuine methodological control rather than a weaker result. Every other case study in this set reports a completed deployment with a measured outcome attached. JLR&#8217;s reports a secured business case, leadership buy-in and use cases &#8220;moving into active development,&#8221; a roadmap-stage engagement rather than a finished one. That&#8217;s not a flaw in the case study; it&#8217;s evidence the other eleven organisations had already passed the stage JLR was still working through when this publication&#8217;s account of its project was written.</p>
<h2>Successes</h2>
<p>Where these case studies report a measured result, the results are large and specific rather than vague. Amey&#8217;s bid drafting time fell from four days to 30 minutes, a 95% reduction, with 80% of tender content now generated through the platform and, in the organisation&#8217;s own account, 100% of previously siloed institutional knowledge retained rather than lost to staff turnover. Dynamiq&#8217;s client cut contract review time from 1.5 hours to 45 minutes, cut the time to answer business queries from two days to 60 minutes, and cut clause identification from 20 minutes to two. Anglian Water&#8217;s Virtual Blue Box cuts manual governance effort by up to 6,000 hours a year, delivered zero minor risks in a subsequent BSI audit, reduced Environment Agency and EPA visit actions by 40%, and is estimated to avoid up to £450,000 in annual costs. Regis Aged Care cut clinical handover review from two to three hours down to under one, with zero hallucinations recorded during trials and nearly 60% of users engaging with the assistant daily or several times a week. Ferndown Town Council cut meeting preparation time by 40%.</p>
<p>Velotix&#8217;s result is the most dramatic in relative terms: a conversational assistant that would otherwise have taken six months or more to build launched in one month, an 80%-plus reduction in development time, with an expected 60 to 70% cut in compliance costs and up to 95% fewer manual tasks. Yepic.AI&#8217;s growth figures are the clearest commercial validation in the set: Yepic Studio generated 1 million videos, and the company&#8217;s monthly revenue grew from $2,000 to $50,000 within five months. AkzoNobel&#8217;s app achieved adoption rates above 95%, and Policy-Insider.AI now handles roughly 100,000 queries a day at peak, scaling with major political events rather than breaking under them. Across all eleven completed deployments in this set, not one reports a negative or null result; where a case study is candid about a gap, as Amey&#8217;s and Dynamiq&#8217;s client&#8217;s accounts are about the absence of any downside mentioned at all, that absence is itself worth reading cautiously rather than as proof nothing went wrong.</p>
<h2>Things to learn</h2>
<p>The first lesson from reading these twelve together is that the size of the result tracks the narrowness of the problem, not the ambition of the AI. The deployments with the largest, most specific, most confidently reported numbers, Amey, Dynamiq&#8217;s client, Anglian Water, Velotix, all automated a single, well-bounded task with a clear existing correct answer: a bid response format, a contract clause, a compliance policy, an audit record. The deployments with output that&#8217;s harder to verify independently, generative video, chatbot conversation quality, event-app satisfaction, report adoption and growth figures rather than accuracy or time-saved figures, because there often isn&#8217;t a single correct answer to measure against.</p>
<p>The second lesson is that infrastructure choices in this set were rarely about the AI model itself. Four companies chose the same cloud provider for the same non-technical reason, GDPR and data sovereignty, and two chose IBM&#8217;s watsonx platform for enterprise integration and on-premises flexibility rather than model quality. A board evaluating a vendor for a similar deployment should expect the infrastructure conversation to be dominated by compliance and integration requirements specific to its own regulatory environment, not a comparison of model benchmarks.</p>
<p>The third lesson is the one Jaguar Land Rover&#8217;s case study makes visible by not fitting the pattern of the other eleven: a roadmap-and-business-case stage is a legitimate, necessary part of an AI programme, not a sign of a stalled one, and a board should expect its own early-stage AI initiatives to look like JLR&#8217;s account rather than Amey&#8217;s or Velotix&#8217;s finished numbers. Reading a roadmap-stage case study against a completed-deployment one as though they represent the same level of achievement is exactly the kind of imprecise comparison that makes AI case studies less useful than they should be, and precisely the comparison a UK C-suite should avoid making when it reviews its own AI programme&#8217;s progress against outside examples.</p>


Twelve AI Deployments Compared: What Networks Journal’s Own Case Study Archive Actually Shows

<h2>Key Takeaways</h2>
<ul>
<li>Apollo Global Management, which manages $938 billion in assets, confirmed that hackers accessed its cloud systems between July 6 and July 10, 2026, exposing names, dates of birth, home addresses, contact information and Social Security numbers.</li>
<li>Google&#8217;s threat intelligence team tracks the group behind this campaign as UNC6671, operating under the aliases Falcon, Helix, Pink and Redact; subsequent reporting on that research has tied the campaign to Apollo, Blackstone, Bridgewater and Bain Capital, among other firms.</li>
<li>The attackers do not rely on malware or software exploits. They call employees on their personal mobile phones, impersonate the internal IT helpdesk, and talk victims into entering credentials and multi-factor authentication codes on lookalike login pages.</li>
<li>Apollo is offering affected individuals 24 months of complimentary credit monitoring and identity protection through Cyberscout, including proactive fraud assistance, with enrollment required within 90 days.</li>
<li>Google&#8217;s researchers recommend phishing-resistant, FIDO2-based authentication, shorter session lifetimes, and stricter controls on IT helpdesk identity verification as the most effective defenses against this style of attack.</li>
</ul>
<div style="border: 1px solid #ddd; border-radius: 8px; padding: 20px 24px; margin: 24px 0; background: #f9f9f9;">
<h3 style="margin-top: 0;">Social Engineering Attacks: 2023–2026 at a Glance</h3>
<p style="margin-bottom: 8px;"><strong>Most reported social engineering techniques against enterprises (industry threat reporting, 2023–2026):</strong></p>
<ul style="margin-bottom: 8px;">
<li>Phishing and spear-phishing email remains the most common initial-access technique reported across the period, typically used to harvest credentials or deliver malicious links and attachments.</li>
<li>Voice phishing (vishing), including help desk and IT support impersonation, has grown sharply as a distinct category since 2023, driven by campaigns targeting large enterprises through calls to employees&#8217; personal phones.</li>
<li>Adversary-in-the-middle (AiTM) phishing kits, which proxy a real login session to steal credentials and session cookies in real time, have become a standard tool for bypassing traditional multi-factor authentication.</li>
<li>SIM swapping and MFA-fatigue (push-bombing) attacks continue to be used to defeat one-time-passcode and push-based authentication.</li>
<li>Business email compromise, where attackers impersonate executives or vendors to redirect payments, remains one of the costliest categories by reported financial loss, according to the FBI&#8217;s Internet Crime Complaint Center.</li>
</ul>
<p style="margin-bottom: 0; font-size: 0.9em; color: #555;">Figures reflect patterns described in public threat intelligence reporting, including from Google/Mandiant, the FBI IC3, and industry incident-response reports, rather than a single unified dataset.</p>
</div>
<p>Private equity firms manage some of the most sensitive information in the financial system: the personal data of limited partners, the financial details of portfolio companies, and deal information worth billions of dollars before it becomes public. That combination has made them a priority target for a hacking campaign that does not need to break through a firewall or exploit a piece of software. It only needs to get one employee on the phone.</p>
<h2>What happened at Apollo</h2>
<p>Apollo Global Management, the private equity firm that manages $938 billion in assets and employs roughly 5,000 people, confirmed that hackers gained unauthorized access to certain of its cloud platforms between July 6 and July 10, 2026. The firm disclosed the incident in a <a href="https://oag.ca.gov/ecrime/databreach/reports/sb24-628551" target="_blank" rel="nofollow noopener">breach notification letter filed with the California Attorney General</a> on August 20, 2026, which confirmed at least 500 California residents were affected; the total number of people impacted nationwide has not been made public.</p>
<p>The categories of data involved were names, dates of birth, contact information, home addresses, and Social Security numbers, according to the filing. Apollo has said it has no evidence, at this time, that the information has been publicly posted or used for identity theft or fraud.</p>
<p>Apollo was not alone. Press coverage of the same UNC6671 campaign, drawing on the Google research described below, has reported that Blackstone, Bridgewater and Bain Capital were also targeted, among a wider group of firms across other sectors caught up in the same threat actor&#8217;s activity.</p>
<h2>What they&#8217;re doing about it</h2>
<p>Apollo&#8217;s response follows the standard playbook for a breach involving Social Security numbers and other identifying data. The firm is providing affected individuals with what its notification describes as &#8220;complimentary access to Credit Monitoring and Identity Protection Services at no charge.&#8221; Enrolled individuals receive alerts &#8220;for twenty-four months from the date of enrollment when changes occur to your credit file,&#8221; giving them an early warning if someone tries to open a line of credit or otherwise use their identity fraudulently.</p>
<p>Alongside credit monitoring, Apollo is providing access to Cyberscout, a service that offers what the notification describes as &#8220;proactive fraud assistance.&#8221; Cyberscout&#8217;s model typically pairs the monitoring alerts with a case manager who helps a victim work through the practical steps of freezing credit, disputing fraudulent accounts and replacing compromised identity documents if fraud does occur, rather than leaving individuals to navigate that process alone. Enrollment is time-limited, with individuals given 90 days from the date of the letter to sign up. Apollo reported $938 billion in assets under management at the time of disclosure; the firm&#8217;s total has continued to grow since, underscoring just how much sensitive client and deal data now sits behind the credentials these attackers are after.</p>
<p>Credit monitoring and identity protection are a reasonable, and now fairly standard, response once a breach involving Social Security numbers has already happened. But they are a remedy for affected individuals after the fact. They do nothing to close the gap that let the attackers in, and boards at other financial services firms are increasingly asking a harder question: what would have stopped this before it started.</p>
<h2>How firms are hardening themselves before an incident</h2>
<p>Financial services firms outside the private equity and asset management space have already had to answer that question, and the steps they&#8217;ve taken are instructive. In a recent case study on this site, building products supplier Lambson used a <a href="https://www.networksjournal.com/content/lambson-building-products-penetration-test-cloud-overhaul" target="_blank" rel="nofollow noopener">penetration test to identify weaknesses in its cloud environment</a> and worked through a structured cloud security overhaul before those weaknesses could be exploited. Separately, packaging manufacturer Allpack put in place <a href="https://www.networksjournal.com/content/allpack-protects-growing-workforce-with-automated-dark-web-monitoring" target="_blank" rel="nofollow noopener">automated dark web monitoring</a> to catch employee and customer credentials that had already leaked, before they could be used against the company in exactly the kind of credential-based attack now being used against private equity firms.</p>
<p>Both cases point to the same underlying principle: the most damaging attacks against enterprises today rarely start with a sophisticated exploit. They start with a stolen or guessed credential, or with an employee talked into handing one over. Firms that test their own defenses against that reality, rather than assuming their perimeter security is enough, are the ones catching these gaps before an attacker does.</p>
<h2>Remedies for individuals: what to do if you&#8217;ve been affected</h2>
<p>For individuals who receive a breach notification like Apollo&#8217;s, or who suspect their data may be involved in this campaign, security practitioners generally recommend:</p>
<ul>
<li><strong>Enroll in the credit monitoring offered.</strong> Where a company the size of Apollo offers free monitoring through a service like Cyberscout, enrolling within the stated window costs nothing and provides an early warning system for fraudulent activity.</li>
<li><strong>Place a credit freeze with all three major credit bureaus</strong> (Equifax, Experian and TransUnion), not just the monitoring service offered by the breached company. A freeze blocks new lines of credit from being opened in your name until you lift it, and is free to place and remove.</li>
<li><strong>Watch for follow-on phishing.</strong> Breached personal data, including names, birth dates and addresses, is commonly used to make subsequent phishing or vishing attempts against the same individuals more convincing. Treat unexpected calls or emails referencing personal details with added scrutiny, particularly anything claiming to be from a bank, the IRS, or an employer&#8217;s IT department.</li>
<li><strong>File an identity theft report</strong> with the Federal Trade Commission at IdentityTheft.gov if you notice any signs of fraudulent activity, which creates a recovery plan and supporting documentation for disputing fraudulent accounts.</li>
</ul>
<h2>How to avoid becoming the next headline</h2>
<p>For financial services firms looking to avoid being the next name in a breach notification, the tactics used against Apollo and its peers point directly to the defenses that would have blunted them:</p>
<ul>
<li><strong>Move to phishing-resistant, FIDO2-based authentication</strong> rather than one-time passcodes or app-based push notifications, which can be defeated by adversary-in-the-middle (AiTM) phishing kits, tools that sit between a victim and a real login page to intercept credentials and session tokens as they&#8217;re entered in real time.</li>
<li><strong>Tighten IT helpdesk identity verification.</strong> Because these attacks rely on convincing an employee that the caller genuinely is internal IT, requiring a second, independent verification step, such as a callback to a known number or verification through a manager, before any password reset or MFA re-enrollment, closes the exact opening these attackers use.</li>
<li><strong>Shorten session lifetimes and enforce re-authentication</strong> for sensitive systems, so that a stolen session token has a smaller window in which to be useful to an attacker.</li>
<li><strong>Centralize authentication through single sign-on</strong> so that security controls, monitoring and anomaly detection apply consistently across every application employees use, rather than varying system by system.</li>
<li><strong>Run regular social engineering simulations</strong> against staff, including phone-based pretexting, not just email phishing tests, since this campaign&#8217;s primary technique is a phone call, not an email.</li>
</ul>
<h2>What happens next</h2>
<p>According to Google security researchers, who published detailed <a href="https://cloud.google.com/blog/topics/threat-intelligence/unc6671-targets-financial-services-and-enterprise-cloud-environments" target="_blank" rel="nofollow noopener">threat intelligence on this campaign</a> earlier this month, the group behind it, tracked as UNC6671 and operating under the aliases Falcon, Helix, Pink and Redact, has been steadily shifting its focus toward higher-value targets. Google&#8217;s researchers describe the group&#8217;s targeting moving from manufacturing, real estate, healthcare and insurance in the spring, to technology and intellectual property-heavy targets by early summer, and then specifically to financial services, private equity and law firms by July, sectors the researchers note are attractive for their mergers and acquisitions activity, capital deployment decisions and sensitive litigation data.</p>
<p>The technique itself has stayed consistent throughout: calls to employees&#8217; personal mobile phones, impersonating IT helpdesk staff with an urgent pretext, most often a mandatory multi-factor authentication or passkey enrollment update, that directs the employee to a convincing but fake login page. Once credentials and authentication codes are entered there, the attackers use adversary-in-the-middle infrastructure to capture and reuse the live session, giving them access without ever needing to guess a password or exploit a software vulnerability.</p>
<p>Google&#8217;s researchers also noted that the group&#8217;s domain registration activity accelerated through June and July, with new lookalike domains appearing roughly once every 1.6 days by mid-summer, up from once every 2.2 days earlier in the year, a sign the campaign shows no indication of slowing down. For financial services firms managing sensitive client and deal data, the message from researchers is that the exposure isn&#8217;t hypothetical: it is an active, ongoing campaign that has already reached several of the largest names in the industry.</p>
<h2>Who can help</h2>
<p>Firms looking to test their own exposure to this style of attack before an incident, rather than after, typically start with the same categories of service Apollo and its peers are now being asked about publicly. <a href="https://www.digitalxraid.com/?source=NetworksJournal.com" target="_blank" rel="noopener nofollow">DigitalXRAID</a>, a UK-based cybersecurity company, offers a dedicated social engineering testing service that simulates phishing and pretexting attempts against a workforce and follows up with targeted training to close any gaps identified, alongside broader penetration testing, red teaming, and a 24/7 CREST-accredited security operations centre for firms that want ongoing monitoring and incident response instead of a one-off test.</p>
<p>For an industry built on protecting other people&#8217;s capital, the lesson from this summer&#8217;s campaign is a simple one: the weakest point in a financial services firm&#8217;s security is rarely its software. It&#8217;s the phone call an employee didn&#8217;t expect to have to question.</p>


Private Equity Firms Like Apollo Are Getting Hacked. Here’s What They’re Doing About It

<h2>Key Takeaways</h2>
<ul>
<li>Lockheed Martin, KPMG and Nationwide Building Society, a defence contractor, a professional services firm and a UK financial mutual, all sequenced their <a rel="nofollow" href="https://www.networksjournal.com/ai">AI</a> programmes the same way: consolidate and govern the underlying data first, then build AI on top of it. That pattern held across three organisations with almost nothing else in common, which is itself worth taking seriously.</li>
<li>Lockheed Martin&#8217;s own published pilot numbers are worth reading precisely rather than as an unqualified success: an early generative AI question-answering system improved from 45.45% response accuracy to 56.8% with prompt engineering and to 66.0% after further query optimisation. Against general, inexact industry benchmarks for enterprise retrieval-augmented Q&#038;A systems, which commonly range from roughly 60% to the mid-80s depending on task and tuning, though no single authoritative figure exists, 66% sits at the lower-to-middle end, a credible, improving, honestly reported result rather than a standout one.</li>
<li>KPMG&#8217;s case study contains no quantified outcome at all, but the underlying confidentiality stakes are real and specific, not generic: professional codes including the ICAEW Code of Ethics impose a standing duty of client confidentiality that survives the end of an engagement, and ICAEW&#8217;s own technical guidance requires firms to actively manage conflicts of interest, precisely the risk an AI system with poorly controlled access across many clients&#8217; data could create if access controls aren&#8217;t built first.</li>
<li>Two of the three, Lockheed Martin and Nationwide Building Society, built their governance layer with <a rel="nofollow" href="https://www.ibm.com/solutions/artificial-intelligence">IBM</a>, whose watsonx.governance platform was independently named a Leader in 2025&#8217;s Gartner Magic Quadrant, Forrester Wave and IDC MarketScape for AI governance platforms, a genuine, analyst-confirmed market position distinct from the consumer-facing model providers, <a rel="nofollow" href="https://openai.com/solutions/">OpenAI</a>, Anthropic, Google, that dominate headlines but don&#8217;t compete in this specific governance-platform category.</li>
<li>Context worth holding onto throughout: MIT&#8217;s NANDA research group reported in August 2025 that 95% of enterprise generative AI pilots deliver no measurable return on investment, and only 5% reach production. Judged against that backdrop, all three organisations here, imperfect, still-in-progress results included, are already ahead of where most enterprise AI efforts currently stall.</li>
</ul>
<p>Three organisations with almost nothing in common, a defence and aerospace contractor, a Big Four professional services firm, and a UK building society, arrived at the identical sequencing decision for their AI programmes: govern and consolidate the data first, then build on top of it. That&#8217;s a genuinely useful pattern for a UK C-suite to notice, and it&#8217;s worth reading each of the three cases precisely, including where the published numbers are modest rather than triumphant, rather than treating every AI case study as either a success story or a cautionary tale.</p>
<h2>Lockheed Martin: real numbers, honestly modest</h2>
<p>Lockheed Martin, the global aerospace and defence company, had valuable data locked away across 46 disparate systems spanning multiple data lakes, data management, analytics and business intelligence tools, making it difficult to put that data to consistent use across the enterprise. &#8220;Data is the foundational element by which we pull everything together across the enterprise,&#8221; said Stephan Gerali, Chief Architect and Senior Fellow at Lockheed Martin. Working with IBM, Lockheed Martin replaced those 46 systems with a single, connected and accessible data environment built on IBM watsonx.data, along with watsonx.data integration and intelligence tools. With a unified, scalable data foundation in place, the company built out a broader AI ecosystem, culminating in the Lockheed Martin AI Factory, a secure environment where 10,000 engineers build, iterate on and deploy AI solutions at scale, accelerated by IBM Granite open AI models. Agentic frameworks and virtual agents developed inside the AI Factory, powered by watsonx.governance and watsonx Orchestrate, now help manage complex workflows including handling HR-related inquiries through natural language. &#8220;We&#8217;re getting closer each day to a data-driven culture where folks can take the data they have and immediately make use of it,&#8221; Gerali said.</p>
<p>The specific figure worth reading carefully: in an early generative AI question-answering pilot, response accuracy rose from 45.45% to 56.8% with prompt engineering, and to 66.0% after query optimisation. That&#8217;s a real, transparently reported improvement, and it&#8217;s worth being honest about where 66% actually sits. Enterprise retrieval-augmented Q&#038;A systems commonly report accuracy figures ranging from roughly 60% up into the mid-80s depending on the task and how heavily the system has been tuned; there&#8217;s no single authoritative industry-wide benchmark, figures vary hugely by domain and evaluation method, but against that general spread, 66% reads as a credible, still-improving result at the lower-to-middle end, not a standout one. That&#8217;s not a criticism of Lockheed Martin&#8217;s disclosure, if anything the opposite: publishing an honest, incrementally improving figure rather than a rounded-up success number is precisely the kind of transparency a defence contractor&#8217;s own governance context would predict. The US Department of Defense adopted five formal AI Ethical Principles in February 2020, Responsible, Equitable, Traceable, Reliable and Governable, developed by the Defense Innovation Board, followed by a 2021 implementation plan and specific AI ethics guidance for contractors from the Defense Innovation Unit. That framework applies across a defence contractor&#8217;s AI use generally, not only to weapons systems, which is a plausible, if not explicitly stated, part of why Lockheed Martin&#8217;s own account of this pilot reads as a careful progress report rather than a marketing claim.</p>
<h2>KPMG: no number at all, and a genuinely specific reason the governance mattered first</h2>
<p>KPMG, one of the Big Four professional services firms, needed better mechanisms for securing sensitive information across a complex data estate while maintaining regulatory compliance and data governance standards, and wanted its consultants to be able to access valuable insights safely rather than being blocked by fragmented controls. Following a successful pilot, KPMG signed a three-year engagement with Aiimi to deploy its AI-powered Workplace AI platform, helping the firm classify, refine and govern its data landscape. The platform lets teams identify, secure and intelligently classify data while respecting retention rules, access controls and client obligations. &#8220;To have trust in AI outputs you must first have trust in your underlying data. The Aiimi platform gives us that trust,&#8221; said Chris Allen, Chief Data Officer at KPMG UK. The three-year engagement gives KPMG a structured foundation for governing its data estate as it scales its data and AI ambitions across the firm.</p>
<p>Unlike Lockheed Martin, KPMG&#8217;s case study contains no quantified outcome whatsoever, no accuracy figure, no time saving, no cost reduction. That&#8217;s worth naming plainly rather than filling in with assumption. What&#8217;s genuinely worth understanding, though, is why the governance-first sequencing wasn&#8217;t optional for a firm like KPMG in a way that goes beyond generic caution. Professional codes governing accountancy and professional services firms, including the ICAEW Code of Ethics, impose a standing duty of client confidentiality that survives the end of a specific engagement, and ICAEW&#8217;s own technical guidance specifically requires firms to identify and actively manage conflicts of interest. For a firm serving competing clients simultaneously, an AI system with poorly controlled access isn&#8217;t a hypothetical risk, it&#8217;s precisely the mechanism through which one client&#8217;s confidential information could inadvertently inform work product delivered to a competitor. That&#8217;s a real, citable, professional-standards basis for KPMG&#8217;s approach, not just sound general practice, and it&#8217;s a more specific reason to build access controls before scaling AI than the case study itself spells out.</p>
<h2>Nationwide: the third data point in the same pattern</h2>
<p>Nationwide Building Society took the same sequencing approach at a third kind of institution again, a UK financial mutual rather than a defence contractor or a professional services firm, building an AI Centre of Expertise with IBM Consulting and Microsoft Azure OpenAI Service before scaling deployment, a case study this publication has examined in detail elsewhere, including the real, separately-reported improvement in customer letter response times that emerged after the original case study&#8217;s governance-first framing, alongside Nationwide&#8217;s own acknowledgement, reported separately, that broader return on investment across its wider AI rollout remains difficult to quantify. The relevant point for this comparison is narrower: Nationwide is the third organisation in this set to build the governance layer before the measured result, reinforcing rather than complicating the pattern visible at Lockheed Martin and KPMG.</p>
<h2>The vendor pattern worth naming plainly</h2>
<p>Two of these three organisations, Lockheed Martin and Nationwide Building Society, built their governance layer specifically with IBM, either directly through watsonx.governance or via IBM Consulting. That&#8217;s not incidental: IBM&#8217;s watsonx.governance platform was independently named a Leader in Gartner&#8217;s first AI Governance Platforms Magic Quadrant, The Forrester Wave for AI Governance Solutions, and the IDC MarketScape for Unified AI Governance Platforms, all in 2025, a genuine, three-firm analyst consensus specifically in the enterprise AI governance category, distinct from the consumer-facing model providers, OpenAI, Anthropic, Google, that dominate general AI coverage but don&#8217;t compete in this particular governance-platform space at all. KPMG&#8217;s approach with Aiimi sits outside that specific IBM pattern, a reminder that &#8220;governance-first&#8221; is a genuine cross-industry principle, not proof that every large enterprise is converging on identical vendor infrastructure to get there.</p>
<h2>What a UK C-suite should actually take from all three</h2>
<p>The most useful context for reading any of these three case studies is one none of them state directly: MIT&#8217;s NANDA research group reported in August 2025 that 95% of enterprise generative AI pilots deliver no measurable return on investment, and only 5% ever reach production. Against that backdrop, Lockheed Martin&#8217;s honestly modest 66% accuracy figure, KPMG&#8217;s unquantified but professionally well-justified governance build, and Nationwide&#8217;s governance-first sequencing followed by a real, if partial, measured result, are not underwhelming stories. They&#8217;re evidence of three organisations that got further than the overwhelming majority of enterprises currently attempting the same thing, precisely because each one treated the unglamorous data and governance work as the actual project, rather than a delay before the real one began. For a board weighing its own AI investment, the specific lesson isn&#8217;t which vendor to pick or which sector to imitate. It&#8217;s that the sequencing itself, data and governance before scale, appears to be the genuine differentiator, and that a case study reporting a modest, improving number is, on the evidence here, a better sign than one reporting no number and claiming full success.</p>


Enterprise AI’s Real Bottleneck Isn’t the Model, It’s the Data: Comparing Lockheed Martin, KPMG and Nationwide’s Governance-First Approach

<h2>Key Takeaways</h2>
<ul>
<li>Bodyguard, a French cyber-bullying protection app founded by Charles Cohen in 2017, built its hateful-comment detection model using OVHcloud&#8217;s AutoML platform rather than a custom-built machine learning pipeline, and the choice worked: detection accuracy rose from 80 to 90 percent, false positives fell from 6 to 3 percent, and the company reports deleting more than 2 million hateful comments in 20 months.</li>
<li>AutoML automates the parts of building a machine learning model a data scientist would otherwise do by hand, choosing an algorithm, tuning its parameters, engineering features from raw data, which is precisely why a founder without a dedicated ML research team, exchanging nearly 80 pieces of metadata against a hard specification that the model&#8217;s error rate could not exceed 10 percent, could get a working, improving model into production rather than needing to build one from first principles.</li>
<li>The specific problem Bodyguard set out to solve, distinguishing genuine hate from irony, sarcasm and humour, is a well-documented hard problem in natural language processing, not just a marketing framing. Academic research on sarcasm and irony detection consistently finds that standard sentiment and toxicity classifiers struggle to hold their accuracy on ironic text without additional contextual signal, which is exactly the gap Bodyguard&#8217;s 80 pieces of metadata, including reaction time and the percentage of upper-case letters, was built to help close.</li>
<li>The regulatory backdrop has firmed up considerably since this kind of tool first mattered. Under the UK&#8217;s Online Safety Act, Ofcom&#8217;s illegal content codes of practice became enforceable on 17 March 2025 and its children&#8217;s safety codes require mitigation measures including age assurance from 25 July 2025, though Ofcom&#8217;s own consultation has explicitly declined to set a concrete cap on acceptable false-positive rates for automated moderation, leaving that judgement to individual services, Bodyguard&#8217;s own hard 10 percent ceiling included.</li>
<li>AutoML&#8217;s real advantage here was speed and accessibility, not necessarily a higher performance ceiling than a bespoke model could reach. That&#8217;s a genuine, documented tradeoff in the wider AutoML literature, not a criticism specific to Bodyguard: automated pipelines lower the expertise barrier and cut time to deployment, while a hand-built model with continual retraining against evolving adversarial behaviour, exactly what content moderation faces as bad actors adapt, generally has more room to be pushed further over time. Bodyguard&#8217;s case study describes real, useful results within roughly two years of operation, not a claim that AutoML was the ceiling of what&#8217;s achievable.</li>
</ul>
<p>The underlying problem Bodyguard set out to solve isn&#8217;t really a machine learning problem first, it&#8217;s a linguistics problem: telling the difference between a genuinely hateful comment and one that only reads as hateful out of context, sarcasm, dark humour, in-group banter. That&#8217;s a documented, actively researched hard case for automated systems, not something Bodyguard&#8217;s own marketing invented to sound impressive. What makes this case study useful for a UK C-suite is less the specific numbers, though they&#8217;re real, and more the choice behind them: Bodyguard built its detection model on an AutoML platform rather than assembling a bespoke machine learning pipeline, and that choice is worth understanding on its own terms, including where it helps and where it has real limits.</p>
<h2>What Bodyguard actually built</h2>
<p>Bodyguard is a real-time cyber-bullying protection app, and, per its published case study with OVHcloud, its predictive model now flags hateful comments with 90 percent accuracy, having deleted more than 2 million such comments over a 20-month period. The core technical challenge wasn&#8217;t just spotting an obviously abusive word, it was working out who a comment was actually aimed at and whether its tone was genuinely hostile or only read that way out of context, which meant the model needed an added layer capable of catching irony, sarcasm and humour rather than flagging them as hate. Cohen&#8217;s team built that model by feeding it nearly 80 separate pieces of metadata, among them how quickly a comment was posted after the content it responded to and what proportion of it was typed in upper case, against a specification that fixed the model&#8217;s acceptable error rate at no more than 10 percent.</p>
<p>&#8220;The technology also needed to be capable of detecting irony, sarcasm, and even humour. The predictive model created with the OVHcloud AutoML machine learning platform really helped me achieve this,&#8221; said Charles Cohen, founder and CEO of Bodyguard. He added: &#8220;I have never been a victim of cyber-bullying myself, but I grew up with everyone around me using social networks. I could see the harm caused by online hate. Cyber-bullying restricts freedom of expression, and this is what I struggled with when I was a teenager.&#8221; Cohen&#8217;s team used the platform to move detection accuracy up ten points, from 80 to 90 percent, while cutting the false-positive rate in half, from 6 to 3 percent, and relied on OVHcloud&#8217;s separate Logs Data Platform, paired with Grafana, to keep watch on infrastructure performance and key metrics as the system ran. Bodyguard itself is a real, established French company, founded in 2017 by Cohen, who built the underlying technology alone that year before the consumer app followed; by 2020 the company had reported around 75,000 app users, and OVHcloud&#8217;s own case study cites more than 40,000 users and 97 percent satisfaction as of July 2019.</p>
<h2>What AutoML actually is, and what it isn&#8217;t</h2>
<p>AutoML is a specific, well-defined category of tooling rather than a vague marketing term, it automates the parts of building a machine learning model that a data scientist would otherwise do by hand: selecting which algorithm to use, tuning that algorithm&#8217;s parameters, and engineering useful features out of raw data. That&#8217;s precisely why it suited Bodyguard&#8217;s situation. A founder without a dedicated in-house machine learning research team could still get a working model into production against a hard, defined specification, an error rate that could not exceed 10 percent, using nearly 80 pieces of metadata as inputs, without needing to build the underlying model-selection and tuning process from first principles.</p>
<p>What AutoML trades away for that accessibility is worth being honest about, and it&#8217;s a documented tradeoff in the wider technical literature, not a weakness unique to Bodyguard&#8217;s choice. Because AutoML automates model selection and tuning as a largely automated, multi-objective process, balancing accuracy, interpretability and speed without a practitioner hand-tuning every decision, it generally offers less fine-grained control than a bespoke pipeline built and continually refined by a specialist team. In adversarial domains specifically, where the people generating hateful content actively adapt their language to evade detection, a hand-built model with ongoing, deliberate retraining against evolving behaviour typically has more room to be pushed further over time than an automated pipeline that isn&#8217;t being continually retrained against the same moving target. None of that makes Bodyguard&#8217;s approach wrong, the results reported, a ten-point accuracy gain and a fifty percent relative cut in false positives, are real and useful achievements within roughly two years. It does mean AutoML should be read here as the tool that got Bodyguard to a strong, deployable result quickly, not as evidence that it represents the highest ceiling achievable on this specific, genuinely difficult problem.</p>
<h2>The problem is genuinely hard, not just difficult to market</h2>
<p>It&#8217;s worth taking Bodyguard&#8217;s stated challenge seriously rather than treating it as a founder&#8217;s framing of an easy problem to sound impressive. Detecting sarcasm and irony in text is an active, specifically named research area in natural language processing, and the consistent finding is that standard sentiment and toxicity classifiers struggle to hold their accuracy when text is ironic, because the words used often imply something close to the opposite of their literal meaning, a signal that requires context most classifiers don&#8217;t have access to by default. A peer-reviewed study specifically on sarcasm and irony classification applied to cyberbullying detection reinforces that this isn&#8217;t a hypothetical edge case for a tool like Bodyguard&#8217;s, it&#8217;s close to the central technical challenge the product exists to solve. The 80 pieces of metadata Bodyguard&#8217;s model draws on, including how quickly a comment was posted after the original content and how much of it is in upper case, are the kind of contextual proxy signal this line of research suggests is needed to close that gap, though the specific feature set is Bodyguard&#8217;s own and not something the wider literature prescribes directly.</p>
<h2>The regulatory ground has shifted underneath this kind of tool</h2>
<p>Bodyguard&#8217;s technology predates the UK&#8217;s current regulatory framework for online harms, but that framework is now directly relevant to any company building detection tools like it. Under the Online Safety Act, Ofcom&#8217;s codes of practice on illegal content became enforceable on 17 March 2025, covering seventeen categories of illegal harm including hate offences, with risk assessments due the day before. Separately, Ofcom&#8217;s Protection of Children codes, published in April 2025, require mitigation measures, including &#8220;highly effective&#8221; age assurance, from 25 July 2025. It&#8217;s worth being precise about what the Act does and doesn&#8217;t require here: its provisions on proactive automated detection are narrowly scoped, largely to child sexual abuse material, terrorism content and intimate image abuse, rather than a general legal mandate for <a rel="nofollow" href="https://www.networksjournal.com/ai">AI</a>-driven detection of harassment or hate speech of the kind Bodyguard targets.</p>
<p>On the specific tension Bodyguard&#8217;s own 10 percent error-rate specification was designed to manage, over-removal versus under-removal, Ofcom&#8217;s own consultation process has explicitly declined to set a concrete cap on acceptable false-positive rates for automated moderation tools, stating that the impact will depend on the service in question, leaving each platform to set and justify its own threshold rather than imposing one centrally. Commentary from legal and digital rights analysts has flagged that the Act&#8217;s free-expression safeguard is a comparatively weak &#8220;have regard to&#8221; duty rather than a binding standard, and that over-moderation carries its own real risk to legitimate speech. Bodyguard&#8217;s own hard ceiling, an error rate that could not exceed 10 percent, reads as a company setting a deliberately tighter internal standard than regulation currently requires, worth noting as a genuinely responsible design choice rather than a coincidence of the numbers looking tidy.</p>
<h2>Why this problem is worth solving at the scale Bodyguard describes</h2>
<p>The scale of the underlying problem gives Bodyguard&#8217;s figures real weight rather than treating them as an isolated success story. Ofcom&#8217;s own Children and Parents research, published in 2024, found that 32 percent of UK children aged 8 to 17 have experienced online bullying, with the specific behaviours measured affecting girls somewhat more than boys in that survey. Set against that backdrop, a tool reporting more than 2 million hateful comments deleted in 20 months, with a measured, improving accuracy rate rather than a vague claim of success, is addressing a documented, widespread problem rather than a manufactured one.</p>
<h2>What a UK C-suite should take from this</h2>
<p>The lesson isn&#8217;t that AutoML is always the right choice, or always a compromise. It&#8217;s that AutoML solved a specific, real problem for Bodyguard, getting a founder without an in-house ML research function to a working, improving, tightly specified model quickly, and that this is a genuinely different value proposition than the one a bespoke, continually hand-tuned pipeline offers to an organisation with the resources to build and maintain one. For a board evaluating a similar build, the honest question isn&#8217;t which approach is better in the abstract, it&#8217;s whether the organisation has, or is willing to build, the specialist capacity a bespoke pipeline requires to outperform AutoML over time, and whether the problem itself, like Bodyguard&#8217;s, is well enough defined by a clear specification, an error rate that cannot exceed a stated number, that an automated pipeline can be pointed at it and trusted to deliver.</p>


Latest