Intelligence Hub | Category Market Intelligence

Decision at a glance

Top move

AI is now executing parts of live intrusions, which shortens patch-and-response windows and raises the cost of incident containment for buyers

Key takeaways

AI is now executing parts of live intrusions, which shortens patch-and-response windows and raises the cost of incident containment for buyers.[1]
Untamed AI agents and machine identities create governance gaps that let automated workflows act with employee-level authority unless identity controls are extended to non-human actors.[2]
Platform owners are shifting authentication defaults (passkeys) away from SMS/voice and will move telecom delivery to third-party providers, creating new integration and pass-through billing choices buyers must plan for.[3]

Why this matters for the category manager

AI is now executing parts of live intrusions, which shortens patch-and-response windows and raises the cost of incident containment for buyers. Untamed AI agents and machine identities create governance gaps that let automated workflows act with employee-level authority unless identity controls are extended to non-human actors. Platform owners are shifting authentication defaults (passkeys) away from SMS/voice and will move telecom delivery to third-party providers, creating new integration and pass-through billing choices buyers must plan for. Carrier-based identity signals (SIM-swap, subscriber matching) are gaining traction as a lower-friction fraud control option, but they introduce new supplier dependency and integration work

What changed

New: Check Point's 2026 report documents AI executing live intrusion steps, making rapid exploit creation operationally real (adds urgency to forensic and SLA clauses) .
New: Microsoft published a passkey rollout and telecom-transition plan that forces buyers to plan third-party telecom selection and testing for SMS/voice fallbacks .
New: Market signal that carrier-based identity offerings are moving from niche to mainstream, highlighted by recognition of Vonage’s Identity Insights product (increases supplier choice but also concentration risk) .

Category impact

Cost / money

Faster weaponisation of vulnerabilities increases near-term patching and incident-response spend because exploits can be produced within hours, compressing remediation windows.[1]
Migration off SMS/voice to passkeys will create new commercial touchpoints and potential telecom pass-through charges where regulators or business needs require legacy methods.[3]

Supplier / commercial

Vendors that package agent governance, telemetry or non-human identity services can gain pricing leverage; RFPs should mandate transparency on metering and logs to limit cost pass-throughs.[2]
Cloud platform changes to default authentication will force downstream suppliers to revise integration scopes, testing windows and commercial warranties tied to identity.[3]
Carrier-identity providers (SIM-signal products) become negotiating levers for fraud control but may also concentrate critical capabilities into fewer suppliers.[4]

Safety / operations

AI-driven attacks widen the blast radius and shorten detection-to-impact time, so runbooks, escalation SLAs and supplier forensic cooperation must be validated for real incidents.[1][2]
Autonomous agents that act on behalf of employees increase risk of unintended actions; operations must verify entitlement least-privilege and runtime governance before large-scale agent rollouts.[2]

What to watch

Early-signal: platform vendors and telecom partners may start offering metered or partner-delivered authentication services with short commercial windows; require telemetry and clear billing pass-through terms before adoption.[3]
Early-signal: suppliers focused on agent governance could shorten quote validity and push for managed-service terms as demand grows — preserve negotiation leverage by specifying scope and acceptance milestones.[2]

Category manager actions

Action detail for this brief

Today's priorities

Inventory machine identities, deployed AI agents and the suppliers that provision them across critical systems.

because unmanaged non-human identities can act with authority and you need a supplier-to-endpoint map to prioritise governance and contract clauses.

Due 3d

high

Identify user groups and systems that currently rely on SMS/voice multifactor and flag exceptions for a passkey migration plan.

because Microsoft will shift SMS/voice delivery to third-party telecoms and affected groups need procurement and testing plans for continuity and billing.

Due 3d

high

Update RFP/SOW language to require model-usage telemetry, prompt and exploit logging, and transparent metered-billing mechanics for any supplier offering agentic or AI-driven fe...

because AI can rapidly weaponise vulnerabilities and variable billing models can create uncontrolled pass-through costs without telemetry.

Due 21d

high

Supplier radar

SecurityBrief Australia

high

Observed supplier signal

Vendors that package agent governance, telemetry or non-human identity services can gain pricing leverage; RFPs should mandate transparency on metering and logs to limit cost pass-throughs.

Commercial implication

Vendors that package agent governance, telemetry or non-human identity services can gain pricing leverage; RFPs should mandate transparency on metering and logs to limit cost pass-throughs.

Next step: Validate the source-backed signal with incumbents and alternates before the next award or pricing decision.

SecurityBrief Australia

high

Observed supplier signal

Cloud platform changes to default authentication will force downstream suppliers to revise integration scopes, testing windows and commercial warranties tied to identity.

Commercial implication

Cloud platform changes to default authentication will force downstream suppliers to revise integration scopes, testing windows and commercial warranties tied to identity.

Next step: Validate the source-backed signal with incumbents and alternates before the next award or pricing decision.

SecurityBrief Australia

high

Observed supplier signal

Carrier-identity providers (SIM-signal products) become negotiating levers for fraud control but may also concentrate critical capabilities into fewer suppliers.

Commercial implication

Carrier-identity providers (SIM-signal products) become negotiating levers for fraud control but may also concentrate critical capabilities into fewer suppliers.

Next step: Validate the source-backed signal with incumbents and alternates before the next award or pricing decision.

Negotiation levers

Lever

Inventory machine identities, deployed AI agents and the suppliers that provision them across critical systems.

Use when

because unmanaged non-human identities can act with authority and you need a supplier-to-endpoint map to prioritise governance and contract clauses.

Expected outcome

Shortlist of machine identities, owning suppliers and priority escalation contacts for follow-up.

high confidence

Lever

Identify user groups and systems that currently rely on SMS/voice multifactor and flag exceptions for a passkey migration plan.

Use when

because Microsoft will shift SMS/voice delivery to third-party telecoms and affected groups need procurement and testing plans for continuity and billing.

Expected outcome

List of affected groups, contingency options and owners responsible for pilot/testing decisions.

high confidence

Lever

Update RFP/SOW language to require model-usage telemetry, prompt and exploit logging, and transparent metered-billing mechanics for any supplier offering agentic or AI-driven fe...

Use when

because AI can rapidly weaponise vulnerabilities and variable billing models can create uncontrolled pass-through costs without telemetry.

Expected outcome

Sourcing documents that enforce telemetry, metered-billing clarity and contractual audit rights.

high confidence

Talking points

AI is now executing parts of live intrusions, which shortens patch-and-response windows and raises the cost of incident containment for buyers.

Untamed AI agents and machine identities create governance gaps that let automated workflows act with employee-level authority unless identity controls are extended to non-human actors.

Platform owners are shifting authentication defaults (passkeys) away from SMS/voice and will move telecom delivery to third-party providers, creating new integration and pass-through billing choices buyers must plan for.

Recommended actions

Do now

Inventory machine identities, deployed AI agents and the suppliers that provision them across critical systems.
Why: because unmanaged non-human identities can act with authority and you need a supplier-to-endpoint map to prioritise governance and contract clauses.
Owner: Category
Expected outcome: Shortlist of machine identities, owning suppliers and priority escalation contacts for follow-up.
[2]
Identify user groups and systems that currently rely on SMS/voice multifactor and flag exceptions for a passkey migration plan.
Why: because Microsoft will shift SMS/voice delivery to third-party telecoms and affected groups need procurement and testing plans for continuity and billing.
Owner: Ops
Expected outcome: List of affected groups, contingency options and owners responsible for pilot/testing decisions.
[3]

Next few weeks

Update RFP/SOW language to require model-usage telemetry, prompt and exploit logging, and transparent metered-billing mechanics for any supplier offering agentic or AI-driven fe...
Why: because AI can rapidly weaponise vulnerabilities and variable billing models can create uncontrolled pass-through costs without telemetry.
Owner: Contracts
Expected outcome: Sourcing documents that enforce telemetry, metered-billing clarity and contractual audit rights.
[1]
Run integration pilots with identity providers and selected telecom partners to validate passkey flows, user experience and commercial terms for SMS/voice fallbacks.
Why: because platform defaults are changing and pilots will surface integration, UX and third-party billing issues before full deployment.
Owner: Ops
Expected outcome: Validated integration plan, tested fallback paths and clearer supplier commercial options.
[3]

Watch

Negotiate contract clauses requiring timely forensic evidence handover, defined incident response SLAs and remediation commitments for suppliers with identity or agent access.
Why: because AI-driven intrusions can exploit vulnerabilities quickly and procurement needs enforceable cooperation terms to contain incidents.
Owner: Legal
Expected outcome: Contracts that secure forensic access, response SLAs and supplier remediation obligations.
[1]
Assess supplier concentration for identity and agent-governance tools and develop staged sourcing or contingency runbooks for alternative providers.
Why: because specialist vendors may gain leverage as demand grows and single-provider reliance increases operational risk.
Owner: Category
Expected outcome: Prioritised contingency list and a staged onboarding playbook for critical identity and agent governance providers.
[2]

What to watch

Early-signal: platform vendors and telecom partners may start offering metered or partner-delivered authentication services with short commercial windows; require telemetry and clear billing pass-through terms before adoption
Early-signal: suppliers focused on agent governance could shorten quote validity and push for managed-service terms as demand grows — preserve negotiation leverage by specifying scope and acceptance milestones
Early-signal: platform vendors and telecom partners may start offering metered or partner-delivered authentication services with short commercial windows; require telemetry and clear billing pass-through terms before adoption.: Early-signal: platform vendors and telecom partners may start offering metered or partner-delivered authentication services with short commercial windows; require telemetry and clear billing pass-through terms before adoption
Early-signal: suppliers focused on agent governance could shorten quote validity and push for managed-service terms as demand grows — preserve negotiation leverage by specifying scope and acceptance milestones.: Early-signal: suppliers focused on agent governance could shorten quote validity and push for managed-service terms as demand grows — preserve negotiation leverage by specifying scope and acceptance milestones
AI is now executing parts of live intrusions, which shortens patch-and-response windows and raises the cost of incident containment for buyers
Untamed AI agents and machine identities create governance gaps that let automated workflows act with employee-level authority unless identity controls are extended to non-human actors
Platform owners are shifting authentication defaults (passkeys) away from SMS/voice and will move telecom delivery to third-party providers, creating new integration and pass-through billing choices buyers must plan for
Carrier-based identity signals (SIM-swap, subscriber matching) are gaining traction as a lower-friction fraud control option, but they introduce new supplier dependency and integration work

Market pulse

Index	Latest	Change	As of
Palo Alto (PANW)	320	+0.00 (+0.00%)	Jul 14, 2026, 10:08 PM
CrowdStrike (CRWD)	285	+0.00 (+0.00%)	Jul 14, 2026, 10:08 PM
Zscaler (ZS)	195	+0.00 (+0.00%)	Jul 14, 2026, 10:08 PM
Fortinet (FTNT)	72	+0.00 (+0.00%)	Jul 14, 2026, 10:08 PM

Palo Alto: Palo Alto movement reinforces investor focus on rapid-response security controls; procurement should prioritise forensic SLAs and telemetry in sourcing
Fortinet: Fortinet index activity signals appetite for network and edge security spend—use this to justify testing and procurement for agent-aware controls

Evidence and sources

Inline citations jump here. Expand a source to read stored evidence excerpts.

[1] AI now runs parts of cyber attacks, Check Point says

securitybrief.com.au · n.d.

Original linkExpand

Source excerpts

Among the report's main findings, AI can now turn a newly disclosed vulnerability into a working exploit within hours. That sharply shortens the patching and response windows security teams have typically relied on

Check Point says the report was based on real incidents, telemetry and case studies gathered over the past year

Check Point also documented attacks in which AI handled exploitation workflows autonomously

Open original source

[2] Agentic rollout creates new identity security challenge

securitybrief.com.au · n.d.

Original linkExpand

Source excerpts

Because agents inherit the permissions of the employees they represent, overly broad user access can significantly increase organisational risk. Reducing standing privileges limits the potential damage an agent can cause, while generating valuable usage data showing precisely which resources employees and agents genuinely require

Managing these non-human identities is becoming an increasingly important security priority

"I've been at SailPoint for 15 years in identity management and identity security for probably 20

Open original source

[3] Microsoft makes passkeys default for Entra ID logins

securitybrief.com.au · n.d.

Original linkExpand

Source excerpts

On February 1, 2027, Microsoft will retire its telecom delivery for SMS and voice authentication and stop offering those methods as a native Entra feature. Organisations that still need SMS or voice for regulatory, technical or business reasons will be able to choose a telecom partner through the Microsoft Security Store and will pay any related charges billed by that partner

Under the plan, users who currently use SMS or voice for multifactor authentication in Microsoft Entra ID will be automatically enabled for passkeys and prompted to register one the next time they sign in with multifactor authentication. Microsoft will later end its own telecom delivery for SMS and voice authentication in Entra ID and shift customers that still need those methods to third-party providers available through the Microsoft Security Store

Customers that must retain SMS or voice in some cases should identify the affected user groups, select a supported telecom provider through the Security Store from late October 2026, and test the setup with a pilot group before broader deployment. Key dates More information on supported telecom providers, deployment guidance, pricing and commercial terms will be shared on September 18, 2026

Open original source

[4] Vonage wins a Merit Award for Identity Insights API

securitybrief.com.au · n.d.

Original linkExpand

Source excerpts

Identity Insights is part of the Vonage Protection Suite, which also includes Fraud Defender and the Verify API with Silent Authentication. The tools can be deployed separately or together, depending on how companies structure fraud prevention and identity verification

Vonage positions the API as part of that effort, using carrier-based identity information in real time. Identity Insights is part of the Vonage Protection Suite, which also includes Fraud Defender and the Verify API with Silent Authentication

"We are honored to be recognized by the Merit Awards for Business for the impact Vonage Identity Insights is making for enterprises and their customers," said Christophe Van de Weyer, president and head of business unit API at Vonage. "This recognition highlights Vonage's leadership in advancing network powered intelligence for fraud prevention and compliance - drawing on a broad set of real-time signals sourced directly from the network, including SIM Swap detection and Subscriber Match for KYC

Open original source

[5] Palo Alto

finance.yahoo.com · n.d.

Original linkExpand

No stored excerpt is attached to this source.

Open original source

[6] Fortinet

finance.yahoo.com · n.d.

Original linkExpand

No stored excerpt is attached to this source.

Open original source

Prepare Identity Controls as AI Enables Faster Autonomous Attacks

Decision at a glance

What changed

Category impact

Cost / money

Supplier / commercial

Safety / operations

What to watch

Action detail for this brief

Today's priorities

Supplier radar

Negotiation levers

Talking points

Recommended actions

Do now

Next few weeks

Watch

Top stories

AI now runs parts of cyber attacks, Check Point says

Agentic rollout creates new identity security challenge

Microsoft makes passkeys default for Entra ID logins

Vonage wins a Merit Award for Identity Insights API

Market pulse

Evidence and sources