Reassess Identity, Connectivity and Agentic AI Procurement Risks

What happened

Blackpoint Cyber launched an autonomous identity response agent that is generally available for Microsoft 365 and Google Workspace and is bundled across ITDR service tiers. The vendor reports average containment in under two minutes and as fast as 21 seconds, making the feature operationally meaningful for MSP clients. Watch how suppliers surface containment thresholds, human-escalation gates and rollback controls during renewal negotiations

Why the category manager should care

Treat automated containment as a negotiated service attribute and require clear containment thresholds, human escalation windows and rollback controls because automated actions can impact downstream systems and liabilities

Key facts

• Generally available for Microsoft 365 and Google Workspace
• Vendor reports average containment under two minutes, as fast as 21 seconds
• Included across ITDR service tiers at no additional cost

What happened

Telstra suffered a nationwide mobile network outage that disrupted services for customers and businesses across states and sectors. The outage affected payments, authentication, healthcare coordination and visibility into cyber-physical systems, making carrier dependence operationally visible. Watch for carrier post-incident reports and whether carriers offer concrete failover or verified-telemetry remedies

Why the category manager should care

Treat carrier outages as supplier performance and architecture risk; validate which services absolutely require continuous mobile connectivity and which can run autonomously

Key facts

• Nationwide mobile outage affecting customers and businesses across Australia
• Disruptions reported across banking, retail, logistics and healthcare
• Central monitoring and control functions for cyber-physical systems lost visibility

What happened

ReliaQuest described a data extortion cluster called Helix that uses voice phishing, device-code phishing and automated SharePoint enumeration to capture session tokens and perform bulk data theft. The attack sequence separates sign-in (using residential IP patterns) from scripted collection, which reduces the window for containment and increases the need for fast session revocation. Procurement should prioritise retainer terms, runbook access and supplier coordination clauses for identity-centrics incidents

Why the category manager should care

Prioritise supplier commitments for immediate session revocation, evidence preservation and rapid coordination because attackers are exploiting sessions and automating collection

Key facts

• Campaign uses voice phishing and device-code phishing to capture valid session tokens
• Automated SharePoint enumeration and bulk exfiltration followed credential capture
• Shared infrastructure links Helix to known extortion ecosystems

What happened

Gartner analysts identified a new phase where agentic AI, model efficiency competition and rising consumption costs are reshaping enterprise choices; most organisations remain at medium or low maturity. The report highlights higher token/API consumption, additional governance and monitoring needs, and a gap between vendor claims and operational readiness. Buyers should demand billing transparency, model-continuity guarantees and evidence of controlled rollouts before accepting agentic features in delivery

Why the category manager should care

Assume agentic features increase supplier delivery costs and governance burden; require billing transparency, monitoring and caps because unchecked agent usage can blow out consumption spend

Key facts

• Agentic systems are heavily marketed, but only a minority of organisations run agents in prod
• Agentic workloads drive higher model consumption and add governance/monitoring costs
• Majority of organisations still at low-to-medium AI maturity, increasing supplier integration