By Craig Lusher, Principal Solutions Architect, Continent 8 Technologies. Part of our Cybersecurity Awareness Month series exploring today’s most important cybersecurity challenges and opportunities.
Think about how you protect your home.
You might have a lock on the front door, an alarm system, security cameras and insurance in case something goes wrong. If one layer fails, there are others behind it.
Cybersecurity works in much the same way.
Yet many organisations still look for a single solution that will solve all their security challenges. The reality is that no individual control, product or service can stop every threat. Passwords can be stolen. Software can contain vulnerabilities. Employees can make mistakes. Even the best security technologies have limitations.
The goal of cybersecurity is not to build a perfect defence. It is to reduce risk by ensuring that when one control fails, another is ready to take its place.
This approach is known as defence in depth.
Attackers rarely rely on a single technique.
A phishing email may lead to compromised credentials. A vulnerable application may provide an entry point into a network. A stolen password may be combined with social engineering or malware to gain deeper access.
The more layers of protection an organisation has in place, the harder it becomes for an attacker to achieve their objective.
For example, a compromised password is far less valuable if multi-factor authentication is enabled. A software vulnerability is less likely to result in a major incident if a web application firewall can detect and block malicious activity. And if an attacker does gain access, monitoring and response capabilities can help identify suspicious behaviour before significant damage occurs.
Each layer may not stop an attack on its own, but together they can significantly reduce the likelihood and impact of a successful compromise.
Building multiple layers of security is important, but those layers also need to be aligned with the risks an organisation faces.
Not every business has the same attack surface, the same regulatory obligations or the same threat profile. A highly regulated online gaming operator will face different risks than a software provider or a retail business.
This is where a threat-informed approach becomes valuable.
Rather than trying to protect everything equally, organisations should focus on how attackers are most likely to target their environment and prioritise controls accordingly.
A simple analogy is home security. If break-ins in your area are mostly occurring through back gardens, you would probably strengthen the back gate before replacing the front door.
The same principle applies to cybersecurity. Understanding how attackers operate helps organisations invest time, effort and budget where it will have the greatest impact.
While every organisation’s security programme will look different, most effective strategies include a combination of preventive, detective and recovery controls.
These commonly include:
The strength of a defence-in-depth strategy does not come from any one of these controls. It comes from how they work together.
One of the most common misconceptions about cybersecurity is that it is purely a technology challenge.
In reality, effective security depends on people and processes just as much as technology.
Threat intelligence only has value if somebody acts on it. Security policies only work if they are followed. Monitoring tools only help if alerts are reviewed and investigated.
By Craig Lusher, Principal Solutions Architect, Continent 8 Technologies. Part of our Cybersecurity Awareness Month series exploring today’s most important cybersecurity challenges and opportunities.
Most successful cyberattacks do not begin with a sophisticated exploit or a dramatic system failure.
More often, they start with a series of small weaknesses that appear harmless on their own but become far more dangerous when combined.
The following scenario is based on a real incident Continent 8 helped investigate and recover from. Names, figures and specific technical details have been changed, but the lessons remain relevant to organisations of all sizes.
It started with a seemingly routine process.
Customers uploaded documentation through a web portal as part of a normal verification process. Unknown to the organisation, the software handling those uploads contained a flaw. Files that appeared to be rejected were still being stored by the application.
An attacker exploited the weakness by uploading files containing hidden malicious code.
When a member of staff later interacted with one of the files, the attacker gained a foothold within the environment. Additional user accounts were created, sensitive information became accessible and attempts were made to conceal the activity from view.
The attacker then targeted financial systems.
A large transaction was initially blocked by approval controls, but a smaller transaction successfully passed through automated processes and was completed.
Fortunately, unusual activity was noticed before greater damage could occur, allowing the organisation to take action.
What followed was a challenge faced by many businesses during a security incident.
Systems were taken offline. Internal teams worked to understand what had happened. Customers were impacted. Leadership teams were forced to make critical decisions under pressure while balancing operational, financial and reputational concerns.
At the same time, investigators identified additional malicious activity, revealing that the original compromise was not the attacker’s only avenue into the environment.
A structured recovery process was put in place.
Systems were restored in stages, credentials were rotated, security controls were strengthened and monitoring was increased. Once the root cause was identified and addressed, normal operations were restored.
The technical details are less important than the lessons the incident provides.
First, attackers often exploit weaknesses that organisations are unaware of. A routine process, such as file uploads, can become an entry point if not properly secured.
Second, no single security control can stop every attack. In this case, multiple safeguards worked together to limit the impact and support recovery.
Finally, people remain one of the most important parts of any security programme. Technology helped detect and contain the attack, but it was ultimately human judgement that recognised unusual activity and prevented greater losses.
Cybersecurity incidents rarely occur because of one major mistake. They happen when several small gaps exist at the same time.
The organisations best prepared for these situations are not those that assume an attack will never happen. They are the ones that continuously look for weaknesses and address them before an attacker does.
To learn how Continent 8 can help with vulnerability management, penetration testing, web application security and security awareness programmes, contact our team.
Two critical flaws in PHP, the programming language behind a large share of the world’s websites, were made public and fixed on 21 October 2026. Here is what they mean for your business and what to do this week.
The flaws, known as PHP2Shell, let an attacker with no username or password run their own commands on an unpatched web server. In the United States, the Cybersecurity and Infrastructure Security Agency (CISA) has told organisations to patch immediately or take affected systems offline, and in the UK the National Cyber Security Centre (NCSC) is urging organisations to act now. Continent 8 Technologies is advising every customer to treat this as a priority for the coming days.
“PHP2Shell sits in the engine underneath thousands of everyday business websites, so the question for every board this week is simple: do you know everywhere PHP runs, including at your suppliers and partners, and has each of those systems been updated? Our security teams are already working with customers to answer that question”, said Anthony Abou-Jaoude, Chief Transformation Officer, Continent 8 Technologies.
The two flaws carry the industry reference numbers CVE-2026-109618 and CVE-2026-109619. Researchers at Calif, Wiz and OpenAI found them with the help of AI tools and reported them privately to the PHP project in August. Details leaked online on 20 October, so the PHP security team released its fixes a day earlier than planned and rated both flaws 9.2 out of 10.
The weakness sits in PHP itself rather than in any single website or product. Popular systems built on PHP, including WordPress, Magento and Drupal, are exposed unless the server underneath has been updated. On the day of release, internet scanning company Censys counted more than 2.5 million servers on the internet running PHP, although not all of them will be vulnerable.
Tools to exploit the flaws are now public, and watchTowr reports attack attempts against its monitoring systems. CISA said in its alert that it had not yet seen exploitation, and as of the evening of 21 October no successful attacks had been publicly confirmed. History suggests the gap will be short: when a previous critical PHP flaw was disclosed in 2024, attackers were trying to exploit it within a day, according to Greenbone.
A web server taken over through PHP2Shell gives an attacker a foothold close to player accounts, payment journeys and back-office systems. Security firm Sansec also reports that one of the flaws can leak fragments of server memory, which may include passwords and access keys, even where no takeover happens.
For licensed operators and their suppliers, a breach quickly becomes a regulatory matter wherever they hold licences. In Great Britain, the Gambling Commission expects a security breach that affects the confidentiality of customer data, or stops customers reaching their accounts for more than 12 hours, to be reported as a key event within five working days. The Malta Gaming Authority asks for similar incidents to be reported through its Licensee Portal within 72 hours, and data protection law sets its own 72-hour deadline for personal data breaches. Businesses that handle card payments should note that PCI DSS expects critical security patches to be installed within one month of release.
In the United States, each state gaming regulator, such as New Jersey’s Division of Gaming Enforcement or the Pennsylvania Gaming Control Board, sets its own security requirements for online operators and their suppliers, so check your licence conditions for when an incident must be reported. Every state also has its own data breach notification law with its own deadlines. Companies listed on a US exchange face a further clock: under SEC rules, a cybersecurity incident judged to be material must be disclosed on Form 8-K within four business days of that judgement.
Availability is at stake as well. The NCSC, CISA and the European Union’s computer emergency response team, CERT-EU, all advise taking systems offline or isolating them if they cannot be fixed promptly. A planned maintenance window now costs far less than an unplanned outage or an incident investigation later.
Start by finding out where PHP is running. It is rarely confined to one platform. In our sector it often sits behind affiliate and comparison sites, marketing microsites built on content management systems such as WordPress, internal admin tools, older cashier pages and products bought from third parties. CISA warns that PHP is often built into other software, where it may not be obvious, and the NCSC advises checking every PHP installation, starting with anything reachable from the internet, and not assuming that only out-of-date versions are affected.
Next, update and restart. The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and the major Linux distributions are publishing their own patched packages. Web servers must be restarted after the update, or the old code keeps running. Systems on PHP 8.1 or older no longer receive official fixes and need an upgrade or a vendor patch. Where an update cannot happen straight away, the PHP project has published temporary settings that reduce some of the risk, and a web application firewall (WAF), which filters malicious traffic before it reaches the server, can buy time. Neither replaces the update.
Then check whether anything has already happened. The NCSC recommends looking for backdoors as well as patching. In practice that means searching for web shells, which are small malicious files an attacker leaves behind to keep access, along with unexpected programs started by the web server and unexplained crashes in PHP logs. The attack can succeed without crashing anything, so a quiet system is no proof of a clean one. If a system may have been compromised, change every password and key it held.
Finally, be ready to report and bring your suppliers in. Confirm who decides whether an incident is notifiable, and make sure your compliance team has the reporting deadlines for every regulator you answer to, including gaming, data protection and, for listed companies, securities regulators. Ask every supplier and partner that runs PHP on your behalf to confirm in writing that they have patched and checked for compromise, and keep a record of their answers.
Our secure8 services can support each of those steps.
If you are unsure whether PHP2Shell affects you or your suppliers, contact your Continent 8 account manager or our security team today. If you suspect an active compromise, please get in touch so our analysts can respond as quickly as possible. We will update this advisory as the situation develops.
Fully managed service delivers content acceleration and edge security through a single trusted provider.
Continent 8 Technologies, the leading managed hosting, connectivity, cloud and cybersecurity provider to the global iGaming and online sports betting industry, today announced a partnership with Varnish Software to launch SecureEdge, a new managed service designed to help operators enhance digital performance, strengthen security and support the demands of regulated markets.
SecureEdge combines content delivery, web application firewall (WAF) and DDoS protection in a single solution delivered and managed by Continent 8 Technologies. Through the partnership, Continent 8 becomes the first organisation globally to deploy Varnish CDN in a Box directly across its own network infrastructure, extending its portfolio with capabilities built specifically for sportsbook, casino, live dealer and platform operators.
Justin Cosnett, Chief Product Officer at Continent 8 Technologies, said: “As operators expand into new markets and customer expectations continue to rise, they need digital infrastructure that delivers performance, resilience and security without adding unnecessary complexity. SecureEdge provides a fully managed solution tailored to the realities of the iGaming industry, helping organisations deliver exceptional user experiences while maintaining confidence in the availability and protection of their platforms. Our partnership with Varnish Software allows us to bring proven content delivery and edge security capabilities to customers through the Continent 8 platform they already know and trust.”
Jesper Hedblom, Head of Varnish CDN at Varnish Software, said: “The iGaming industry places unique demands on digital infrastructure, from sudden traffic spikes driven by live events to the need for consistently low latency and strong security. By deploying Varnish technology directly across its network, Continent 8 can provide operators with high-performance content delivery and integrated edge protection through a managed service built specifically for their needs.”
Online betting and gaming platforms regularly experience sharp increases in traffic around major sporting events, tournaments and other high-profile moments. Maintaining performance during these periods is critical to player experience, while evolving cyber threats continue to place additional pressure on operators and their technology teams.
Built to address these challenges, SecureEdge accelerates the delivery of websites, applications, APIs and streaming services while helping safeguard critical infrastructure from malicious traffic and attacks. By processing and filtering traffic closer to end users, the service helps maintain responsiveness during peak periods and reduces the burden on origin infrastructure.
SecureEdge also helps operators meet the requirements of increasingly complex regulatory environments. Delivered through Continent 8’s global infrastructure platform, the service enables organisations to align traffic delivery with market-specific obligations while maintaining a consistent experience for players across jurisdictions.
The launch further strengthens Continent 8’s infrastructure and cybersecurity portfolio, providing customers with an additional solution to support growth, operational resilience and long-term success in highly regulated markets.
SecureEdge is available immediately to new and existing Continent 8 customers. For more information, visit our SecureEdge page or contact your Continent 8 account manager.
The gaming industry has never had more opportunities than it does today.
By Jamie Garcia, Director, Regulatory Security at Continent 8 Technologies
Every conference, every customer conversation, and every industry event seems to introduce the next big thing. Artificial intelligence. Automation. Blockchain. Digital identity. Cloud-native gaming platforms. Cashless wagering. Real-time compliance monitoring. New wagering models. The list keeps growing.
And honestly, that’s a good thing. Innovation is what keeps our industry moving forward.
But after moderating a panel at G2E on balancing innovation, regulation, and cybersecurity, I walked away with a realization that wasn’t really about AI, blockchain, or any specific technology.
The conversation kept coming back to one word: Trust.
Technology will continue to evolve. The real challenge is making sure trust evolves with it. The discussions during the panel repeatedly focused on responsible innovation, cybersecurity governance, regulatory engagement, accountability, and maintaining confidence in new technologies.
One theme that emerged consistently was that organizations are no longer debating whether technologies such as AI will have a role in gaming, but how they can be implemented responsibly within existing regulatory and operational frameworks.
Ten years ago, launching online gaming in a new market felt innovative. Today, innovation is happening across every corner of our industry.
Operators are exploring AI to improve customer support and fraud detection. Suppliers are automating processes that once required significant manual effort. Regulators are evaluating technologies that improve transparency and oversight. Organizations are finding new ways to manage identity, payments, compliance, and security.
The technology itself is rarely the difficult part. The difficult part is figuring out how to implement it responsibly. I’ve seen organizations become so focused on what a technology can do that they forget to ask what risks it introduces.
What data is being collected? Where is it stored? Who has access to it? How is it protected? How do you prove it is operating as intended?
Those are the questions that ultimately determine whether technology succeeds in a regulated environment.
Artificial intelligence was one of the hottest topics throughout G2E, and understandably so.
But what surprised me was how little the discussion centered on AI models themselves. Instead, much of the conversation focused on governance.
How do organizations ensure AI is being used appropriately? Who is accountable for the outcomes? How do you validate answers generated by AI? How do you ensure sensitive data remains protected? How do you explain decisions to regulators, auditors, and stakeholders?
Those questions are far more important than deciding which AI model to use. The model is often the easiest part. The governance is where the real work begins.
Several panelists highlighted that accountability remains one of the biggest challenges in AI adoption. While the technology continues to advance rapidly, organizations still need clear governance frameworks that define ownership, oversight, and decision-making responsibilities.
As gaming organizations continue adopting AI, success won’t be determined by who deploys AI first. It will be determined by who deploys it responsibly.
One of my favorite moments during the discussion came when the conversation shifted from technology back to people.
Because for all the excitement around AI and automation, human oversight still matters. A lot.
Technology can help us make faster decisions. It can identify patterns we might otherwise miss and it can improve efficiency and reduce manual workload.
But technology should support human decision-making, not replace it.
Gaming has always been built on integrity, accountability, and trust. Those principles don’t disappear just because we introduce new technology into the environment.
At the end of the day, accountability still belongs to people.
A mistake I still see organizations make is treating compliance and cybersecurity as final checkpoints before launch.
The product gets built. The architecture gets designed. The integrations get completed. Then someone asks if it’s compliant.
That approach almost always creates unnecessary challenges.
The most successful projects are the ones where compliance, cybersecurity, operations, and product teams are working together from the beginning.
When security and compliance are embedded into the design process, organizations can identify issues earlier, avoid costly redesigns, and launch with significantly more confidence.
That’s not slowing innovation down. That’s making innovation sustainable.
There is occasionally a narrative that innovation and regulation are somehow competing forces.
I don’t see it that way. Having worked with regulators, operators, suppliers, and technology providers across multiple jurisdictions, I’ve found that everyone is generally trying to solve the same problem.
How do we encourage innovation while maintaining integrity, consumer protection, and trust?
Those goals are not mutually exclusive.
In fact, one of the more interesting takeaways from the discussion was the level of alignment between regulators, operators, and technology providers. While perspectives naturally differed, there was broad agreement that early engagement leads to better outcomes for everyone involved.
Cybersecurity is no longer just an IT discussion.
Modern gaming environments are interconnected ecosystems.
Operators rely on cloud providers, payment processors, geolocation vendors, KYC providers, game suppliers, managed service providers, and countless additional technology partners. Every integration creates opportunity. Every integration creates risk.
Several panellists noted that as iGaming ecosystems become more interconnected, managing third-party and supply-chain risk is becoming just as important as securing internal systems and infrastructure.
That’s why cybersecurity must be considered a business requirement rather than simply a technical requirement. Security can no longer be something added immediately before certification or production deployment. It has to be built into the architecture from the start. The organizations that recognize this tend to be the ones that innovate most effectively because they avoid creating unnecessary risk along the way.
The technologies will change. AI will evolve. Blockchain use cases will mature. New products will emerge. Regulations will continue adapting. Cyber threats will continue evolving.
What will remain constant is the need for trust. Trust from regulators. Trust from players. Trust from business partners. Trust from communities.
Innovation allows the industry to grow. Regulation protects integrity. Cybersecurity protects the systems, data, and people that make innovation possible.
Those are not competing priorities. They’re interconnected responsibilities.
And when all three work together, the industry is positioned to do incredible things.
These themes were at the heart of the discussion during my G2E panel, “Balancing Innovation and Regulation in Gaming Cybersecurity,” where industry leaders explored how Gaming can continue embracing emerging technologies while maintaining strong cybersecurity, regulatory compliance, operational integrity, and public confidence.
If there was one takeaway I left the session with, it’s this:
The future of gaming won’t be defined by the technologies we adopt.
It will be defined by how responsibly we implement them.
By Craig Lusher, Principal Solutions Architect, Continent 8 Technologies. Part of our Cybersecurity Awareness Month series exploring today’s most important cybersecurity challenges and opportunities.
Logs are the security camera footage of your technology.
Every login, failed password, file change and account creation leaves a record somewhere. On their own, these events may seem insignificant. Viewed together, they can reveal the early signs of an attack, often before significant damage has been done.
The challenge is that many organisations still lack complete visibility across their environments. New systems are deployed without being connected to monitoring tools, logs are retained for too short a period, or security teams simply do not have the time and resources to investigate every alert.
These gaps create blind spots, and attackers only need one.
When a security incident occurs, visibility becomes critical. Security teams need to understand how an attacker gained access, which systems were affected and whether the threat has been completely removed. Without the right logs, or sufficient retention, answering those questions becomes significantly more difficult.
For organisations looking to strengthen their security posture, three questions are worth asking:
Improving visibility is often one of the most effective security investments an organisation can make. The more complete the picture, the faster teams can identify suspicious activity and respond appropriately.
To help customers achieve this, Continent 8 has modernised the log collector that sits within customer environments and feeds our 24/7 Security Operations Centre (SOC).
The new collector is designed to make onboarding faster and simpler, allowing new systems to be connected in approximately a day instead of weeks. It also processes data significantly faster than the previous generation while requiring fewer computing resources within customer environments.
Importantly, pricing includes unlimited log ingestion within each service tier, removing the need to exclude potentially valuable data sources simply to manage costs.
The service continues to provide the capabilities customers rely on, including 24/7 monitoring, incident review within 30 minutes of alert generation, notification if monitored systems stop sending logs, and long-term log retention to support investigations and compliance requirements.
Good security starts with visibility.
Because if you cannot see what is happening within your environment, neither can you effectively protect it.
To learn more about Continent 8’s managed detection and response capabilities, or to discuss your logging and monitoring strategy, contact your account manager.
By Craig Lusher, Principal Solutions Architect, Continent 8 Technologies. Part of our Cybersecurity Awareness Month series exploring today’s most important cybersecurity challenges and opportunities.
Most technology teams have a mental list of security improvements they would like to make: a penetration test, a phishing exercise, a vulnerability assessment, or simply an independent view of where they stand.
The challenge is rarely identifying what needs to be done. More often, it’s finding the budget and time to do it. Security initiatives can easily fall behind more immediate business priorities, especially when everything appears to be running smoothly.
The problem is that security gaps rarely announce themselves in advance. Small investments can uncover weaknesses long before they become incidents, but many organisations delay taking that first step because they assume it requires a significant new budget.
For Cybersecurity Awareness Month, there’s a simple question worth asking: are you making the most of the security resources you already have available?
That’s the thinking behind Loyalty+, Continent 8 Technologies’ customer rewards programme.
Every dollar a customer spends across Continent 8’s portfolio, whether for cloud, infrastructure, connectivity, managed services, security or intelligence, automatically earns credits. There is no separate sign-up process, and each credit is worth one dollar (or local currency equivalent) that can be redeemed against security services.
For contracts of 12 months or longer, credits for the full contract term are granted upfront once the service is delivered, giving customers immediate access to funds that can be used to strengthen their security posture from day one.
Those credits can be applied to a wide range of services, including vulnerability assessments, penetration testing, phishing simulation campaigns, cyber maturity assessments and security audits. They can also be used towards ongoing solutions such as managed detection and response, web application firewall services, dark web monitoring and managed security operations.
We designed Loyalty+ around a simple principle: customers should be able to direct value where it matters most to their business. Rather than treating security as an additional cost to justify later, the programme helps organisations invest in reducing risk using benefits they may already have available.
The broader lesson extends beyond Continent 8. Before deciding the next security step is out of reach, take a closer look at the programmes, services and resources that already exist within your supplier ecosystem. You may be closer to improving your security posture than you think.
And if you’re a Continent 8 customer, it’s worth checking whether you have Loyalty+ credits available. Unused credits expire after 12 months, turning a potential security improvement into a missed opportunity.
Not sure what your Loyalty+ balance is or how it can be used? Contact your Continent 8 account manager to learn more and explore the security services available through the programme.
New cloud data center combines modular edge architecture, global connectivity and regulatory compliance for operators and suppliers
Continent 8 Technologies, a leading provider of cutting‑edge managed IT solutions designed for the global iGaming and online sports betting industry, has officially opened its new data center facility at Tioga Downs Casino Resort in Nichols, New York.
Developed specifically to meet the technical, operational and regulatory requirements of New York’s online sports betting market, the purpose-built facility provides a secure and compliant environment for licensed operators and approved B2B suppliers serving one of the most significant regulated wagering jurisdictions in North America. Designed as a specialist edge data center, it reflects Continent 8’s approach of delivering industry-specific infrastructure close to the regulated markets it serves, rather than relying on large-scale hyperscale deployments.
Built using Continent 8’s modular design approach, the facility launches with approximately 500kW of capacity and 24 racks, with the ability to expand to 48 racks as customer demand grows. The site is supported by resilient power, cooling, connectivity and security systems and is fully managed by Continent 8.
The New York site extends the company’s unbeatable North American footprint and provides customers with direct access to the company’s private global network, which spans more than 100 locations across five continents, including 30+ US states.
New York is the largest regulated online sports betting market in the United States, generating more than $26 billion in wagers during 2025 alone. The facility has been developed to support the operators and suppliers serving this market, including leading brands such as FanDuel, delivering the infrastructure, connectivity and services required both for today’s operations and tomorrow’s technology requirements.
As operators increasingly explore AI-enabled applications across areas such as customer experience, operations and security, the edge deployment forms part of Continent 8’s broader strategy to support innovation within regulated environments.
Michael Tobin, Founder and Chairman at Continent 8 Technologies, said: “The future of infrastructure for our industry isn’t about building ever-larger facilities. It’s about delivering the right infrastructure in the right locations to support highly regulated markets.”
“New York is a perfect example of that approach. This facility has been developed specifically for the needs of regulated online sports betting operators and suppliers, providing the foundation they need to participate and innovate within the market.”
“We believe edge infrastructure will play an increasingly important role in the future of online sports betting, and we’re proud to be continuing that journey with this opening.”
Mike Small, Chief Executive Officer at Continent 8 Technologies, said: “Operators and suppliers increasingly need more than hosting infrastructure. They need a partner that can support connectivity, cloud, cybersecurity and emerging technologies through a single integrated platform.”
“This facility combines local market presence with access to Continent 8’s global network and managed services capabilities, helping customers deploy, scale and innovate with confidence.”
“As demand continues to grow, we’re looking forward to supporting both existing customers and new entrants as they expand their presence in the market.”
The new deployment reinforces Continent 8’s strategy of delivering market-specific infrastructure that helps operators and suppliers scale with confidence.
Joint venture helps iGaming operators deploy AI at scale with policy-aware, auditable AI applications that meet jurisdictional requirements across every market they serve.
Continent 8 Technologies and FuturePath AI today launched Future8, an AI-native operating company built for regulated operators, formed as a joint venture between the two companies.
Announced at SBC Summit Lisbon, Future8 combines FuturePath’s enterprise AI applications platform with Continent 8’s licensed global operating footprint, enabling the iGaming industry to deploy auditable AI without compromising compliance, data sovereignty and operational control.
Built for highly regulated environments, Future8 enables operators to move from AI experimentation to production deployment by embedding governance, approvals and auditability into every workflow from day one.
Continent 8 brings licensed data centers and a private global network spanning more than 100 locations, built over 28 years serving the biggest iGaming and online brands, along with AI-enabled Global Capability Centers in India, the Philippines and Bulgaria. The company also contributes operational expertise, jurisdictional knowledge and intelligence derived from one of the industry’s largest collections of regulated infrastructure and operational data, helping Future8 tailor AI solutions to the operational realities of the iGaming sector.
FuturePath brings a production enterprise AI applications platform, with pre-built AI applications powered by coordinated agents, already running enterprise operations for Fortune 500 companies across multiple industries. Together, the companies are adapting proven enterprise AI to the workflows, controls and operating realities unique to iGaming. Unlike generic agent frameworks or toolkits, FuturePath delivers regulator-ready AI applications designed to solve real business challenges for licensed operators.
Until now, the iGaming sector has faced a difficult dilemma: how to deploy AI at scale while maintaining the strict, policy-aware explainability that licensing bodies demand across every jurisdiction they operate in. Regulators have moved past asking only where data sits. They now ask how a decision was made, a question AI raises and infrastructure alone never did.
Future8 is built to make that evidence automatic. Because its advantage is regulatory standing rather than physical location, it holds whether a workload runs in a Continent 8 facility, in a public cloud region, or in the operator’s own account.
This allows organizations to standardize AI governance across jurisdictions while retaining flexibility in where and how workloads are deployed.
“Everyone has AI. Almost nobody can run it in a regulated market,” said Mike Small, CEO of Continent 8 Technologies. “Future8 lets operators optimize their business and achieve efficiencies with AI that regulators can actually audit, in every jurisdiction they hold a license.”
“Our AI applications – coordinated agents executing real business work – already run real operations inside Fortune 500 enterprises, with every action governed and auditable,” said Saurabh Bhatia, CEO of FuturePath AI. “Continent 8 brings 28 years of regulatory standing that no AI company can replicate. Together, we are building the AI application and accountability layer licensed industries will need to run AI in production.”
No two iGaming operators run the same way, which is why Future8 is built to deliver outcomes rather than tools alone.
Future8 is designed to meet organizations wherever they are in their AI journey. They can engage through advisory services, managed AI-operated services or direct platform deployment, allowing them to adopt AI at a pace that matches their operational and regulatory requirements.
Its services are organized into three offerings that meet operators at any stage of AI maturity, from first assessment to full deployment:
AI Readiness Assessment for Regulated Industries. A structured evaluation of the operator’s estate, its automation opportunities, and the license conditions that govern them, concluding with a joint executive readout that maps where AI can be deployed and how it will be evidenced.
Managed AI-Operated Services. Future8 assumes the operational workload through a global delivery network, staffed onshore, nearshore, or offshore according to what each jurisdiction requires, so coverage follows the license. The operator pays for outcomes, and the work automates down over time. As automation increases, operators benefit from improved efficiency and faster execution while maintaining the governance and controls regulators require.
Platform Subscription. For organizations that prefer to run AI in their own environment, Future8 licenses the AI applications directly, layered with the jurisdictional policy, control, and evidence artifacts that make them acceptable to a regulator.
The platform can be deployed within Continent 8 infrastructure, public cloud environments or customer-owned environments while maintaining consistent governance controls.
Future8 builds on FuturePath’s field-tested enterprise AI, already proven in Fortune 500 environments, where AI applications, powered by autonomous agents, handle tens of thousands of complex workflows monthly and reduce resolution times by up to 40%. Forward Deployed Engineers work alongside operators to adapt and deploy it to their specific workflows, systems, and regulatory requirements.
Across the iGaming industry’s business, Future8 spans IT and technical operations, cloud migration, finance and procurement, and player-facing operations, with every workflow governed, auditable, and evidenced to the regulator.
Whether deployed as software, consumed as a managed service, or delivered through a hybrid model, Future8 combines AI technology, operational expertise and regulatory oversight into a single offering.
Future8 launches with an initial focus on regulated iGaming, with a longer-term vision to support additional licensed industries where governance, auditability and compliance are essential to AI adoption.
To learn more or book a demo, visit future8.ai.
Continent 8 Technologies, a leading provider of cutting-edge managed technology solutions designed for the global iGaming and online sports betting industry, today announced its expansion into Africa with the launch of a new data centre in Johannesburg, South Africa. The deployment extends Continent 8’s full portfolio of managed technology, connectivity, cloud and cybersecurity solutions into the region, supported by its purpose-built private global network and world-class digital infrastructure.
Live in Q4 2026, the Johannesburg facility marks Continent 8’s first deployment on the African continent and will enable operators, platform providers and content suppliers to deliver faster, more consistent digital experiences to South African players while remaining seamlessly connected with their wider international operations and partners.
As one of the world’s highest-volume regulated betting markets, South Africa demands infrastructure capable of supporting substantial transaction volumes with low latency and high resilience. Located close to market and directly connected to Continent 8’s private global backbone, the new facility will enable customers to leverage the same highly resilient infrastructure used across more than 100 connected locations worldwide. Operators and partners entering or expanding within South Africa will benefit from seamless access, low latency connectivity via a network that ranks among the top 20 most connected globally.
Mike Small, CEO at Continent 8 Technologies, said: “Expanding into Africa is a significant milestone for Continent 8 and a natural next step in our global growth strategy. South Africa is one of the most important, regulated betting markets in the world, and establishing a presence in Johannesburg allows us to bring the full strength of the Continent 8 platform closer to customers operating in the region. Beyond local infrastructure, customers will gain access to our private global network, cybersecurity expertise, cloud ecosystem and one of the most connected networks in the world, enabling them to innovate, scale and operate with confidence across multiple jurisdictions.”
The Johannesburg data centre will provide Tier III infrastructure within an ISO 27001-certified environment and deliver Continent 8’s full portfolio of managed technology services, including colocation, managed infrastructure, cloud connectivity, content delivery, DDoS protection and managed cybersecurity. Customers will also gain access to Continent 8’s private global network, and benefit from direct connectivity to leading hyperscale cloud providers including AWS, Google Cloud and Microsoft Azure.
Andrew Mudge, Head of EMEA Sales at Continent 8 Technologies, added: “Our customers increasingly operate across multiple regulated markets, and they want technology partners that can support that complexity without compromising on performance or reliability. Establishing a presence in Johannesburg allows us to bring our experience and infrastructure proposition directly into the South African market, while giving customers a partner they can scale with as their businesses grow. Just as importantly, they gain immediate access to the connectivity, cloud, security and managed services capabilities that underpin Continent 8’s global platform, helping them accelerate growth both within the region and internationally.“
The launch further strengthens Continent 8’s presence across regulated iGaming markets worldwide and reinforces its commitment to delivering secure, resilient and high-performance infrastructure wherever its customers operate.