Small Language Models, API Security, and Networks: Practical Architecture at Fatec's XI Symposium

Last week, regular classes at Fatec Taubaté made way for the XI Symposium on Technology and Management. I spent three vibrant evenings on a packed campus, filled with busy rooms and discussions that brought me closer to real industry practices.

It was my first symposium in college. I had been worried the sessions might be overly theoretical, but the schedule pleasantly surprised me: on Wednesday we were doing breathing exercises in the auditorium to manage anxiety, on Thursday discussing why running a compact model locally on a laptop makes more sense than burning money on cloud APIs, and on Friday analyzing real intrusion incidents caused by exposed, unauthenticated endpoints. I also discovered the great opportunity Fatec provides to access Cisco courses and certifications for free.

Following the presentations alongside my classmates completely shifted the dynamic. During breaks, we debated the ideas and took advantage of the post-session time to walk up and talk directly with the speakers. Getting questions answered on the spot by practitioners who live the technical routine is worth far more than recorded tutorials. Attending events like Hack’a Valley, Proud Tech Summit, Google Cloud’s Capacita+, and IBM mentorships has only reinforced this conviction, so I keep seeking and taking full advantage of these moments.

The backend of the mind and managing technical anxiety

The opening talk on Wednesday, delivered by clinical psychologist Valquiria Saiki (founder of CEHU - Human Excellence Center), addressed a challenge everyone in technology faces daily: the constant feeling of falling behind. Every week brings a new model, a different framework, a programming language update. It is easy to get anxious trying to keep up with everything and feeling like you know nothing. I have had plenty of days where I caught myself constantly refreshing Reddit, Twitter (X), and feeds, trapped in the sensation that I had to remain glued to every single update.

Valquiria Saiki discussing anxiety management and the cognitive impact of information overload in tech during the symposium opening.

I liked how she framed a comparison that resonated with our studies: separating the visible interface (the frontend) from the automated background processes (the backend of the mind). Real habit changes require consistent repetition to reprogram these automatic reactions, rather than isolated demands that only breed guilt.

Midway through the conversation, the entire auditorium paused to test a practical technique: the physiological sigh, researched by neuroscientists like Andrew Huberman at Stanford. It consists of two deep inhales through the nose followed by a long, slow exhale through the mouth. I already maintain a daily meditation routine developed through my Kung Fu training, but this deep breathing exercise was an outstanding addition for high-stress moments. Over the past two days I put it into practice, and it worked remarkably well to diffuse overwhelm and reset focus. Highly recommended.

How artificial intelligence runs at the edge without massive datacenters

In Thursday’s lecture, Prof. Luís Felipe Féres Santos (who teaches my Integrated Project class this semester and works as a systems analyst at Embraer) demonstrated that Small Language Models (SLMs) can run directly on local hardware with sub-80 ms latencies, eliminating token costs and the risk of leaking proprietary corporate data to external servers.

When the professor asked the auditorium who had already experimented hands-on with AI tools and understood the architectural mechanics of these models, I looked around and noticed very few hands went up. I felt glad to be among those who were already familiar with the concepts. In fact, it immediately reminded me that Google recently opened a generous Google Colab quota for students, which I shared that same week with my classmates so we could run practical experiments without relying on high-end local rigs. I will not use the quota right away because I am focused on other priorities, but I have already added local model benchmarks to my backlog.

Large Language Models (LLMs) are impressive for open-ended abstract reasoning, but they carry steep real-world trade-offs:

• Energy consumption: Datacenters burn anywhere between 20 and 200 watts per operation when handling models with hundreds of billions of parameters.
• Network latency: Round trips to the cloud rarely return responses under 250 ms, making real-time interactions difficult.
• Data privacy: Uploading customer data or personally identifiable information (PII) to third-party APIs creates immediate compliance hurdles.

For everyday tasks, the practical alternative lies in compact models ranging from 100 million to 15 billion parameters (such as Microsoft Phi-4, Google Gemma 3n, Meta Llama 3.2, and Qwen 2.5). What stood out to me in the technical breakdown were the methods used to compress these models:

• Knowledge distillation: A smaller student model learns to replicate the reasoning outputs of a larger teacher model, keeping core logic focused on specialized tasks.
• Pruning: Surgical removal of redundant parameters and weights across the neural network.
• Quantization: Reducing the numerical precision of weights from 16-bit floating point (FP16) down to 4-bit integers (INT4). This cuts memory usage by roughly 4x. For someone developing on a standard student laptop without a multi-thousand-dollar dedicated GPU, this memory reduction is precisely what makes local inference feasible.

With modern processors incorporating integrated neural processing units (NPUs) for matrix math and embedded boards running TinyML on milliwatts, the most balanced architecture is tiered: the cloud handles rare and high-complexity reasoning, while the edge takes over more than 90% of repetitive workflows, such as JSON schema validation and sensitive data masking.

The professor captured this transition with the practical perspective of someone applying these concepts in industry: business units demand AI across every feature, but cloud API bills scale fast. The future of AI computation points toward a modular network of lightweight models embedded directly in everyday devices, reserving reliance on massive datacenters strictly for workloads that genuinely require them.

The role of networking and opening new Cisco tracks on campus

Also on Thursday, Prof. José Geraldo Moraes presented the Cisco Networking Academy catalog accessible to Fatec Taubaté students. The conversation went further, emphasizing that no software runs in a vacuum.

Prof. José Geraldo Moraes introducing Cisco Networking Academy certification paths and courses to college students.

One can spend weeks learning modern web frameworks, but every application still depends on HTTP calls, DNS resolution, packet routing, open ports, and containers communicating across networks.

I was very interested in what the platform offers, from simulators like Cisco Packet Tracer to automation paths like DevNet Associate and security tracks like CCNA. The best part was the professor’s openness to launch a dedicated class for any specific course students want, as long as enough peers show interest for him to check institutional availability. I plan to review the tracks carefully once I complete Harvard’s CS50x, which I have been taking with a strong focus on C fundamentals and memory management.

Why defensive security belongs in every developer’s routine

On Friday night, security consultant Gabriel Grisólia (Kyndryl) showed that most corporate breaches stem from ordinary engineering oversights, such as unauthenticated routes, loose permission models, and exposed configuration variables.

Gabriel Grisólia detailing real API vulnerabilities and the importance of defensive security across the development lifecycle.

I had already met Gabriel when I attended Hack’a Valley back in August in Pindamonhangaba, a conference he helped conceptualize and organize, and which I covered in detail in Beyond the Code: What Hack’a Valley 2026 Reveals About Architecture, AI, and Security. Seeing his talk at Fatec reinforced the lessons from that event. It confirmed that security is not an isolated specialty reserved only for penetration testers or forensic analysts. It belongs directly on the radar of anyone designing databases, building endpoints, and shipping deployments.

He shared real incidents that illustrated this reality:

• Public Swagger UI exposing tax invoices: At an automotive client, an interactive Swagger UI documentation portal sat exposed to the public without authentication. An HTTP 200 GET request returned customer names, vehicle chassis numbers, and 44-digit electronic invoice access keys. With that key in hand, anyone could query the official government tax portal and pull full addresses and transaction amounts, creating immediate social engineering attack vectors and direct privacy violations.
• Exposed perimeter assets: During External Attack Surface Management (EASM) assessments in staging environments, he discovered abandoned diagnostic scripts like info.php, .env files with plain-text credentials, and Git configurations containing deployment tokens. He even showed how attackers leverage simple terminal curl commands to inspect server headers and outdated packages on forgotten subdomains without ever touching a web browser.

With Brazilian national CERT (CERT.br) data indicating 2026 will exceed 103,000 registered Common Vulnerabilities and Exposures (CVEs), vulnerability scanning has become almost entirely automated. I even shared during the discussions that when I first deployed my site on Cloudflare, I immediately observed multiple bots scanning for /.env paths resulting in 404 errors, which I promptly mitigated with strict WAF rules so bots would not burn edge limits. Gabriel’s words during the session summarized the engineering mindset every developer needs:

“In security, it is never a matter of ‘if’, but ‘when’: an incident is inevitable, and the team must be prepared to respond.”

• Gabriel Grisólia, Senior Cybersecurity Consultant at Kyndryl

During Q&A, I asked what he recommended for someone looking to build solid security foundations without getting overwhelmed. He was refreshingly candid: look into entry-level operational paths like SOC event monitoring and governance frameworks like NIST, invest in recognized certifications (such as Cisco’s network security tracks), and maintain the discipline to finish one course before jumping to the next. His closing advice took direct aim at imposter syndrome: do not freeze waiting until you know everything before applying for opportunities.

Architectural trade-offs discussed at the symposium

The technical decisions explored across the sessions proved that no engineering choice comes without compromises. Every path requires weighing infrastructure costs, latency, and operational complexity:

Practical conclusions from the event

The impact of the symposium went far beyond watching talks in an auditorium. The Colab quota is saved for experiments with quantized models, and the networking conversation gave clear direction for my next step: completing CS50 first, then coordinating with my professor and peers to launch the most relevant Cisco track on campus.

Seeing industry practitioners engage in candid, peer-level conversations inside Fatec proves that the real value of engineering education lies in connecting the dots, from application code to underlying infrastructure and security.