Tighten AI Identity and Vendor Terms Ahead of Platform Shifts

What happened

APRA published a Letter to Industry that demands stronger AI governance, identity controls and continuous assurance for AI systems. The regulator explicitly requires identity and access controls to include non-human AI agents and suggests immediate steps for gap assessment and monitoring. Watch whether regulated suppliers and RFPs begin embedding these expectations into contractual and audit clauses

Why the category manager should care

Make AI agents first-class assets in sourcing: require identity governance, monitoring rights and explicit supplier commitments for non-human identities

Key facts

• APRA Letter to Industry on Artificial Intelligence (30 April 2026)
• Guidance includes immediate steps and gap-assessment advice for identity and monitoring
• Directs boards to demonstrate AI literacy and governance alignment

What happened

CrowdStrike was named Forrester XDR Leader, highlighting its unified, AI-enabled detection and response platform and single-sensor approach. The vendor emphasises agentic SOC automation and has shown rapid revenue growth in AI-driven services, which makes telemetry, API access and migration support concrete procurement negotiation points. Watch vendor proposals for explicit telemetry export, playbook definitions and migration guarantees

Why the category manager should care

Treat XDR proposals as platform swaps; demand clear telemetry export, API access and documented playbook behaviour before committing

Key facts

• Named Leader in Forrester Wave: Extended Detection and Response Platforms
• Top scores in Current Offering and Innovation categories
• Vendor cites rapid growth in AI-driven detection services

What happened

Cloudflare launched a Cloudflare One Design Partner program and a Cloudflare One Stack of AI skills to help partners deploy SASE and Zero Trust projects. The move formalises partner roles in migrations and packages partner capability with vendor tooling, making partner competence and migration blueprints operational procurement variables. Watch partner proposals for blueprint completeness, automated workflows and any limits on telemetry or migration exit paths

Why the category manager should care

Treat partner nominations as commercial packaging—require proof-of-capability, documented blueprints and defined responsibilities in SOWs

Key facts

• Cloudflare One Design Partner program launched with named Australian partners
• Introduced Cloudflare One Stack: AI skills, blueprints and automated workflows
• Program aims to accelerate Zero Trust and SASE migrations via channel partners

What happened

Sygnia published research showing the Velvet Ant group maintained long-term access by replacing authentication components (PAM modules and OpenSSH binaries) to persist and evade logging. The operational detail is that attackers reached an offline network segment via staged access chains, making detection and safe cleanup difficult and risky. Watch for vendor-published detection signatures, remediation playbooks and validated rollback techniques for auth stacks

Why the category manager should care

Require vendors to document forensic and remediation support for authentication components and prove recovery steps in non-production

Key facts

• Investigation found compromised environment with modified PAM/OpenSSH components and long-ter
• Attackers used staged access chains through internet-facing systems to reach isolated segments
• Remediation risk: attackers modified admin tooling, complicating eradication and recovery

What happened

Retail contractor management platforms (like Site360) are being used to replace paper logs and provide verified, timestamped visitor records that tie people to site access. The important operational detail is the platform’s geofencing and induction workflows that can be integrated with network logs to validate on-site access against network activity. Watch whether buyers start mandating contractor credentialing and integration with network access controls in vendor SOWs

Why the category manager should care

Require contractor/visitor management integration with network access logs and indemnities for uncontrolled on-site device installations

Key facts

• Platforms replace manual sign-ins with cloud-based onboarding, geolocation and real-time site
• Functionality includes digital inductions, compliance alerts and geo-fence exit verification
• Proven in construction; adoption growing quickly in retail for distributed-site control