Strengthen Identity and Agent Controls Ahead of AI-Driven Threats

What happened

Five Eyes and reporting warn that AI speeds attack lifecycles from quarters to weeks or days, not decades. The core operational detail is that identity security and least-privilege controls are singled out as scalable defences organisations should prioritise now. Watch whether organisations shorten patch and verification cycles and require suppliers to provide faster telemetry and response guarantees

Why the category manager should care

Treat identity controls and faster verification as procurement levers: demand least-privilege enforcement, phishing‑resistant auth, and telemetry SLAs from suppliers

Key facts

• Public warning emphasises defence windows measured in weeks or days
• Identity and least-privilege called out as primary scalable defence

What happened

Coverage shifts from LLM experimentation to agentic AI operational challenges: onboarding many agents, controlling data access, and matching models to task complexity. The important procurement detail is cost control—token consumption and orchestration can drive unpredictable run costs without contract-level billing and audit clauses. Watch vendors' roadmaps for model-choice tooling and billing transparency before committing to wide deployments

Why the category manager should care

Require suppliers to disclose model-routing, telemetry access, and billing mechanics for agent workloads to avoid opaque run costs

Key facts

• Focus on onboarding and governing potentially thousands of AI agents
• Vendors emphasise model-to-task matching to reduce token consumption and costs

What happened

Visa is scaling AI-powered security and keeping human validation as a required step for AI-derived actions, showing a combined automation-plus-governance model. The concrete detail: Visa operates hundreds of models and ties AI to fraud disruption and continuous-defence operations, indicating procurement should look for vendors that combine automation with explainability and auditability. Watch whether regional suppliers follow this combined approach or focus only on automation

Why the category manager should care

Seek providers that document AI governance, offer explainability and keep humans in the decision loop for high-impact security actions

Key facts

• Visa reports operating hundreds of AI models across security and operations
• Approach pairs AI-driven detections with human validation and governance

What happened

Reporting emphasises phishing-resistant authentication (like passkeys and hardware tokens) as a practical control to prevent credential theft that fuels AI-augmented attacks. The operational detail is the ASD Essential Eight guidance endorsing phishing-resistant methods for higher maturity levels, giving procurement a binary control they can mandate in supplier scopes. Watch supplier support for FIDO2/passkeys and availability of hardware-token options for privileged accounts

Why the category manager should care

Include phishing-resistant authentication requirements (FIDO2/passkeys or hardware token options) in contracts for high-privilege access

Key facts

• ASD Essential Eight recommends phishing-resistant authentication for higher maturity organiza
• Options include passkeys and separate-device hardware tokens like YubiKey