Shift Contracts and Runbooks to Match Rising Cyber and Automation Risks

What happened

SonicWall released a vertical Healthcare Protect Brief showing healthcare remains the most persistently targeted industry in its telemetry. The report highlights large exploitation volumes against remote‑access tools and many IoT attack signatures that target unpatchable medical devices, making this operationally real for buyers supporting clinical systems. Watch whether suppliers publish sector-specific patch attestations and segmentation plans as a follow-up

Why the category manager should care

Treat this as an operational demand signal: healthcare environments will require verified patching, segmentation, and supplier incident obligations because attackers exploit constrained uptime tolerance

Key facts

• UltraVNC exploitation generated 13.3 million hits in five months
• 243 unique IoT exploitation signatures targeting medical devices
• Malware hits per firewall reached 102,209 in the first half of the year

What happened

ExtraHop's Global Threat Landscape report finds many ransomware victims detect breaches only after data theft and that attackers stay inside networks for extended periods. The report ties delays to encrypted channels, AI-generated false positives, and overloaded manual triage, making detection and handover a procurement concern. Watch for suppliers to expand managed detection offerings and for RFx language to demand investigation handover metrics

Why the category manager should care

Plan for longer incident timelines and require suppliers to accept clearer handover and investigation responsibilities because many detections occur only after data exfiltration

Key facts

• 49% of ransomware victims detected attacks only after data theft
• Attackers remained inside networks for nearly two and a half weeks on average
• Manual triage and investigation work consume a large share of analyst time

What happened

NBN Co received TM Forum Level 4 validation for an autonomous service assurance system on Fixed Wireless that detects atmospheric ducting and executes mitigation steps automatically. The validation covers intent-to-task conversion, mitigation, and rollback within the fixed‑wireless domain, making the autonomy operationally real for regional uptime. Buyers should map contractual runbook ownership and rollback rights before accepting vendor automation claims

Why the category manager should care

Treat vendor autonomy claims as a negotiable commercial factor: secure runbook ownership, rollback rights, and measurable intent-to-task outcomes because automation changes who executes incident responses

Key facts

• First Australian organisation validated at TM Forum Level 4 for Service Assurance
• Autonomous system detects atmospheric ducting and executes fallback/rollback actions
• Validation focused on the Fixed Wireless service domain supporting regional customers

What happened

ShareGate launched an AI-assistant integrated governance tool for Microsoft 365 that surfaces oversharing risks and provides cross-tenant reporting; early access is available via manual install for existing customers. The release aims to reduce fragmented governance workflows but is currently an early-access product that may require partner service-layering to scale. Validate accuracy, false-positive rates and partner delivery models before wider adoption

Why the category manager should care

Pilot these tools to see if they genuinely reduce governance workload because early-access products may need service-layering by partners to scale across tenants

Key facts

• Integrates AI assistants (ChatGPT, Claude, Microsoft Copilot) for governance workflows
• Early access available to ShareGate Protect users via manual installation
• Includes cross-tenant reporting features and exportable governance reports

What happened

Everpure repositioned from a storage vendor to an enterprise data intelligence provider, launching a knowledge layer to classify and prepare data for AI workloads and delivering via channel partners. The shift creates a platform-plus-services offer that is operationally real through partner-led deployments and may change commercial packaging. Buyers should verify partner capabilities and insist on unbundled pricing if evaluating the new stack

Why the category manager should care

Expect vendors to sell data intelligence as platform-plus-services through partners because channel-only models shift delivery and support responsibility to partners

Key facts

• Announced Pure Data Intelligence knowledge layer for data classification and governance
• Strategy built around a unified data plane and intelligent control plane to support AI workloads
• Channel-only go-to-market, creating a services opportunity for partners