Das Magazin der Universität St.Gallen

AI – Master and Commander: Lessons from graduate student projects and the need for an AI-enriched contract

Can artificial intelligence extend students’ analytical capabilities without displacing their independent judgement? This column reports on a pilot study in a graduate seminar investigating weaknesses in European integration. An ‘AI-enriched contract’ required three elements for students’ presentations: an independent conceptualisation before AI use, an AI-assisted presentation, and a transparency statement. AI-tools accelerated routine execution, widened methodological ambition, and enabled exploration. Students also documented verification, rejected inappropriate suggestions and fabricated quotations, and retained responsibility for organisation and interpretation of findings. While the pilot offers qualified support for AI as a workmate rather than a master, several caveats apply.

Center for Economic Policy Research

Reading the economy from earnings calls with generative AI

Official statistics are getting harder to collect and can arrive late. This column uses generative AI to read managers’ economic outlooks from more than 120,000 corporate earnings calls in the US. The resulting score predicts GDP, employment, and wages beyond the next quarter and carries information that professional forecasters do not.

Center for Economic Policy Research

Politik

Europe faces faster cyberattacks than ever. But many of the solutions are long known

Europe faces faster cyberattacks than ever. But many of the solutions are long known Expert comment thilton.drupal 10 November 2026 Cyberattacks against Europe are becoming more frequent and more damaging. Yet while AI has lowered the barrier to entry, most attacks still exploit old and familiar weaknesses. Last month, hackers caused tons of food to be thrown away after hacking into refrigerators in around 700 French supermarkets. Within weeks, similar incidents were reported in Belgium, Luxembourg, Sweden, Ireland and elsewhere. Nobody has claimed responsibility, but France has accused Iran of carrying out the ‘unprecedented attack’ against it.The freezer attacks come after a spate of cyber incidents across Europe in the last few years that have repeatedly exposed familiar weaknesses. Russia’s war against Ukraine has raised the stakes, putting Europe on the front line of hybrid attacks including through cyber operations. Four problems stand out: old systems that are never fixed, new technology built without security in mind, increasingly capable attackers aided by AI, and states using cyberattacks as instruments of power, often through proxies. Each requires its own response, and Europe is doing better on some fronts than on others. None is a European problem alone, and none will be solved by Europe alone.Vulnerable legacy systems The first problem lies in the weakness already built into the technology Europe runs on. Much of Europe still relies on legacy systems – technology that has reached the end of its life and no longer receives the security patches it needs. The result is a stock of known vulnerabilities that attackers can exploit.The freezer attacks show what this looks like in practice. They were not technically complex: most of the hacked temperature controllers in France were reportedly legacy systems that no longer receive updates. Operational technology of this kind, which controls physical equipment, often stays in service for decades, long after anyone is updating it. Organizations and governments often lack a clear picture of the technology they own and operate. This is not just an issue for companies. The UK’s National Audit Office found in 2025 that government departments used ‘hundreds of ageing legacy IT systems.’ Germany’s federal audit office found in 2025 that parts of the federal government’s networks are so outdated they no longer receive security updates.Part of the problem is visibility: organizations and governments often lack a clear picture of the technology they own and operate. Even when organizations know where the problems lie, replacing old systems is expensive and disruptive. But leaving them in place is becoming increasingly risky.Replacing these systems is primarily the responsibility of national governments and companies that operate them. But the EU is also pushing for it. In July, the European Central Bank told Europe’s largest banks to replace or update legacy systems as part of planning for AI-enabled threats. The financial sector, however, is far ahead of most other sectors, and replacement will require money, expertise and political commitment.In the meantime, basic measures, often referred to as ‘cyber hygiene’, can go a long way. According to ENISA, the EU’s cybersecurity agency, two-thirds of the vulnerabilities attackers exploit already have a patch available. Where equipment no longer receives security updates, organizations need to restrict its exposure or replace it. Europe does not lack information or rules: ENISA maintains a European Vulnerability Database, national agencies issue regular alerts, and the NIS2 Directive makes managing these risks a legal obligation. What is missing is implementation: turning warnings into action, particularly in smaller organizations, and enforcing rules that many member states have been slow to adopt. Technology built without securityThe second problem is that too much technology is still being built without security in mind. This is due to market incentives; manufacturers compete on price, features and speed to market, rather than prioritizing security. The costs of insecurity have mainly fallen on customers and society. The EU has sought to change this. From December 2027, under the EU’s Cyber Resilience Act (CRA), connected products that do not meet basic security requirements will no longer be allowed on the EU market. Manufacturers will be responsible for their security throughout their lifecycle. The underlying problem is poor-quality software. However, the CRA has limits. Manufacturers are required to report actively exploited vulnerabilities, including those affecting products already on the market. But reporting a flaw does not fix it. And for products that manufacturers no longer support, there may be no fix. Someone else then has to act: the shop, hospital or council operating the equipment must know it is affected and have the skills and resources to patch, isolate or replace it. The underlying problem is poor-quality software. AI could help strengthen the security of software by identifying and fixing flaws faster than people can. But that depends on vendors using AI tools (with human oversight) before their products reach the market.More attackers, moving fasterThe use of AI by attackers is compounding these problems. AI is accelerating the process by which attackers are finding and exploiting vulnerabilities in insecure products and ageing systems. It is lowering the skills and resources needed to launch attacks and compressing the time defenders have to respond.This year, frontier AI labs made a series of striking disclosures about their latest models’ cyber capabilities. These capabilities are real, particularly when it comes to exploiting vulnerabilities including in legacy systems. The labs were right to disclose them. But the disclosures also showcased their products, and the hype and catastrophizing that followed have not always helped clarify where priorities should lie. AI is not yet changing the nature of the game so much as its speed and scale. ENISA found that attackers in 2025 relied mainly on off-the-shelf AI tools to sharpen skills they already had. Similarly, the UK’s National Cyber Security Centre found that among the incidents it handled, AI had not enabled ‘a novel class of attack’. Related work Is AI really getting out of control? Instead, the greater danger is that AI-assisted vulnerability discovery gives attackers more opportunities to strike before system owners can apply patches. In response, defenders must be able to act at the same speed. Governments have not yet managed to achieve this. The EU, for example, created the European Cybersecurity Alert System to analyse threat and incident data across member states using AI. However, EU auditors recently found that the system had stalled and was not yet working as intended.A separate challenge is dependence on external providers. Many of the most capable defensive AI tools are developed in the US. Access can be restricted or withdrawn, as US export controls showed in June 2026. Governments need to establish structured ways of working with these companies on early warning, model testing and making defensive tools available to operators of critical infrastructure.Cyber as a tool of state powerThe fourth problem is that states are increasingly using cyber operations as a routine instrument of power, often through proxies. As argued in this Chatham House paper, the war in Ukraine has exposed an entire ecosystem of proxies. The overlap between these actors blurs responsibility and complicates attribution. Europe does not lack the tools to respond to state-backed cyber activity. It has mechanisms for public attribution, criminal investigations, sanctions and diplomatic pressure. But these measures have been slow and applied unevenly, which has reduced their collective impact. Related work Holding state-sponsored hackers and other cyber proxies to account The priority is therefore to use existing instruments more quickly and consistently. This requires coordinating responses across Europe and with international partners.An EU-wide response is only as effective as the national systems underpinning it. Yet all but two member states missed the deadline to adopt the NIS2 Directive, which requires critical sectors to manage risks and report serious incidents. Member states need to improve information sharing, strengthen reporting and practise their responses to attacks. Internationally, states have already agreed not to attack critical infrastructure or knowingly allow their territory to be used for malicious cyber activity. The UN’s new Global Mechanism on ICT security is where Europe and its partners should push to make those commitments count.Familiar threats, less timeThe attacks of the recent weeks may look new, but they tell a familiar story: known weaknesses, insecure products, more capable attackers and slow, fragmented responses. What has changed is the timescale. Europe has already written many of the rules. Its member states now need to secure or replace existing technology, ensure that what comes next is secure by design, put AI to work for defenders, and rehearse a coherent response with partners. That means not only strengthening Europe’s ability to withstand and recover from attacks, but also its capacity to disrupt those responsible and impose costs that deter future operations.

Chatham House

Will the US and Iran return to war?

Will the US and Iran return to war? Expert comment jon.wallace 9 November 2026 That is not only President Trump’s decision. Iran may also reignite the conflict, in an attempt to break the US blockade. In recent weeks there has been considerable speculation that the US would carry out new attacks on Iran once the US midterm elections were concluded. But with the vote complete, Washington’s next move remains unclear. In a recent 60 minutes interview US President Donald Trump said he did not see ‘any reason’ to escalate the war. It is possible that the president chooses not to resume military operations against Iran and settles for continuing the current policy of economic strangulation. But even in that case, a return to armed conflict cannot be ruled out. Tehran is unlikely to absorb US pressure quietly while its economy further deteriorates. This is the irony of the US naval blockade of Iran. There’s evidence to suggest it has effectively hurt the regime’s finances. Iran loaded no oil onto tankers in September according to some analyses. But the blockade is unlikely to succeed in achieving the strategic objective of forcing the regime to make significant concessions at the bargaining table. Instead, it might push Tehran to lash out, which would take all parties back to square one in this conflict.StalemateThe blockade of Iranian oil exports through the Strait of Hormuz has evolved over the past few months. Washington launched the operation back in April; eased it after agreeing to the Memorandum of Understanding (MoU) with Iran in June (which allowed for the reopening of the Strait); then reinstated it on 14 July as the deal unravelled. Want to hear more on the evolving security landscape? Join experts and policymakers at our Security and Defence Conference for candid analysis of today’s most pressing threats. Iran wants the blockade lifted and its conditions met before it reopens and stops its attacks in the Strait. Washington wants concessions on Iran’s nuclear programme before resuming any talks on maritime security.It’s a stalemate. But it may not last long. The deep distrust between the two sides will make Iran doubt that US concessions will be durable enough to bring it lasting economic relief. Some in the regime will believe it is better for Iran to fight on its own terms than collapse from within as the economy is throttled. It will not necessarily require a new US military strike on its territory for Iran to lash out at its neighbours. In 2019, Iran responded to Trump’s economic ‘maximum pressure’ tactics with a series of attacks. In May and June of that year, it struck tankers near Fujairah and in the Gulf of Oman and shot down a US surveillance drone. Then on 14 September, drones and missiles hit Saudi Aramco’s Abqaiq processing facility and the Khurais oil field. The Iran-backed Houthi militia in Yemen claimed responsibility, but the US and Saudi blamed Iran. The message from Tehran was clear: We will respond to extreme economic pressure by attacking Gulf energy infrastructure. Defending a founding narrativeThere are two main reasons why Iran responded this way to economic pressure before – and why it may do so again. The first is ideological. Iran isn’t just defending its shipping lanes and oil exports in this war. It is protecting its founding narrative of sacrifice and endurance. This is what Washington still doesn’t seem to get.Since its founding, the Islamic Republic has staked its reputation on not just resisting outside pressure but also defying it. Sanctions, isolation, and military threats won’t coerce or bring down the regime: that’s the message Tehran keeps telling its constituencies and adversaries. The war with Iraq of 1980 to 1988 provides the clearest illustration of the regime’s commitment to that principle. Iran fought the war almost on its own, against an adversary backed by the US and Gulf states, and it survived. A difficult year or two as a result of a blockade is hardly comparable to what the regime endured at that time. The Iranian leadership is betting that if it holds out long enough, those with the most to lose from this economic crisis…will press Washington harder to find an exit. The second reason is practical: Iranian defiance, unlike during the Iraq war, is now aided by outsiders. The biggest source of support is China, through its purchasing of Iranian oil. No wonder US officials have reportedly urged Beijing to play a more constructive role in ending the conflict. They understand that without China, the regime’s staying power will drastically diminish.Tehran also knows that the Gulf states want the blockade to end. The status quo is causing them tremendous economic pain. The Iranian leadership is betting that if it holds out long enough, those with the most to lose from this economic crisis – Saudi Arabia, the UAE, Qatar, and Kuwait – will press Washington harder to find an exit. There are limits to Iranian resilience, of course. In 1988, after Operation Praying Mantis (a one-off US strike against Iranian naval resources ordered by President Ronald Reagan) and months of mounting losses, Iranian Supreme Leader Ayatollah Ruhollah Khomeini accepted a ceasefire with Iraq. He famously likened it to drinking poison. Yet it showed that when its survival was at stake, Iran could concede (if not surrender).But the blockade is not the same situation at all. In 1988, there was no way Iran could have won the war. Continuing would have probably led to military collapse. Today Iran believes it has the upper hand. Listen to statements by Iranian officials, and it is clear they believe they have already won this contest. That’s partly true. The Iranian regime will, most likely, survive this conflict and possibly avert a new major US attack, which it would define as victory. But it still has to address the blockade. If history is any guide, Iran will at some point resort to violence to try to force Washington to reconsider. That, in turn, is unlikely to succeed: the US has its pride, too, and its interests. US officials are convinced that the blockade is working, so giving it up won’t be easy. If anything, Washington is doubling down by giving US Central Command the green light to establish a new task force meant to ‘prevent Iran from using ground routes to transport advanced weapons and other materials.’There’s only one way out of this stalemate: phased diplomacy, which the two sides are apparently considering. The basic sequencing is clear: In the first phase, Washington would need to partially lift the blockade in exchange for Iran reopening the Strait and ceasing all attacks against shipping. In the second, nuclear talks could take place, including the gradual lifting of sanctions and the release of frozen Iranian funds.The two sides are keen to end the conflict. But they appear equally determined to avoid any perceived humiliation and Israel remains an unpredictable factor. Even now, it is not clear that sense will prevail.

Chatham House

US midterms: The beginning of the end for Trumpism?

US midterms: The beginning of the end for Trumpism? Audio sseth.drupal@c… 6 November 2026 On this week’s episode of Independent Thinking, our experts discuss the result of the US midterms and what it means for US foreign and domestic policy. American voters inflicted a crushing defeat on the Republican Party in the US midterm elections, signalling clear dissatisfaction with President Trump’s agenda. Now many issues in US politics are up in the air – from the use of tariffs to policy on Iran, Ukraine and beyond.How will the Democrats use their new powers? What will the result mean for Trump’s war on Iran and the stability of global energy supplies? And how will the repudiation of Trump’s second term echo around the world?Bronwen Maddox is joined by Laurel Rapp, Lindsay Newman and Andrew Payne of Chatham House’s US and North America Programme to make sense of a seismic week.About Independent ThinkingIndependent Thinking is a weekly international affairs podcast hosted by our director Bronwen Maddox, in conversation with leading policymakers, journalists and Chatham House experts providing insight on the latest international issues.More ways to listen: Apple Podcasts and Spotify.Explore our other Chatham House podcasts.

Chatham House

HSG Focus - The Magazine

Alle Ausgaben

Start me up

Re-interpreting Freedom

Cybersecurity

Economies of Crime

Krise des Westens

Suche

Unternehmertum entsteht jeden Tag aufs Neue

Re-interpreting Freedom

Cybersecurity geht alle an

Illegale Geschäfte im FOCUS

Ein neuer FOCUS. Willkommen!

Neueste Beiträge

Datensouveränität beginnt beim Einzelnen

Longevity und das Startup-Mindset

Fünf Trends, die Innovation und Entrepreneurship verändern

Alpine Achse: Stärke entsteht durch Verbindung

Das HSG-Startup NoxBlanc will die beste Matratze der Welt entwickeln

Bergab zur Milliardenbewertung

Entrepreneurial Champions Programme: HSG stärkt drei Startups mit je 100'000 Franken

Warum der digitale Drogenhandel in Europa boomt

Fokussiert bleiben

Data Centers Will Continue to Be Built, Despite Midterm Elections

New research could lead to faster, trustworthy AI models for climate prediction

AI – Master and Commander: Lessons from graduate student projects and the need for an AI-enriched contract

Reading the economy from earnings calls with generative AI

Europe faces faster cyberattacks than ever. But many of the solutions are long known

Will the US and Iran return to war?

Serbia After the Election: A Heavy Legacy for the New Government

US midterms: The beginning of the end for Trumpism?