Tighten Contractor Controls and Authentication After Access Incidents

What happened

EY fired two staff after they allegedly accessed bank‑account details while working on a Commonwealth Bank contract. The operational detail—contractor access within a client engagement—makes this a supplier control and contractual issue procurement must treat as real. Watch for regulator inquiries or similar disclosures from other consultancies that could widen contractual liability

Why the category manager should care

Treat contractor access as a first‑order control: require background checks, session logging, privilege recertification, and supplier cooperation on forensics

Key facts

• Two EY staff dismissed after alleged access during a bank contract
• Incident linked to a Commonwealth Bank engagement

What happened

A column recounts thieves emptying accounts where banks did not require multi‑factor authentication, citing a real victim example. The concrete takeaway for procurement is that optional MFA materially increases exploitability for integrated services; require enforced authentication or clear compensating controls. Watch vendors that permit opt‑out flows or claim customer choice as an excuse during incidents

Why the category manager should care

Require enforced MFA or documented compensating controls from vendors handling transaction or account data before onboarding

Key facts

• Column describes a consumer losing money due to accounts without enforced MFA
• Columnist highlights that many institutions still offer MFA‑optional flows

What happened

An opinion column highlights token‑minimization tools and rising costs around large models, arguing that AI runtime is becoming a meaningful operational expense. The important procurement detail is that token and memory consumption are now negotiable cost levers—buyers should demand usage transparency and pricing options. Watch supplier pricing models for new caps, committed plans, or hidden shifts to opaque billing

Why the category manager should care

Treat model token and memory use as contractible items: require reporting, caps, or alternative model options to control spend

Key facts

• Column discusses token minimization and rising AI operational costs
• Notes memory‑supply pressures that affected OEM economics

What happened

A startup unveiled a 3D‑printed microreactor module it says could power datacenters and operate for long periods without refueling. The operational reality is prototype demonstrations and optimistic availability timelines; regulatory approval and manufacturing scale remain the main constraints. Watch for vendor safety documentation, regulatory milestones, and independent testing before treating this as a procurement option

Why the category manager should care

Treat microreactor offers as strategic research: collect safety docs, regulatory approvals, and independent validations before any commitment

Key facts

• Company demoed a 3D‑printed reactor core and pressure vessel prototype
• Vendor claims configurations intended to power datacenter‑scale loads