Reassess Contracts and Readiness for Agentic AI and PQC Risk

What happened

Check Point's CTO says AI has compressed the time from vulnerability disclosure to exploitation down to hours for a growing share of cases. The important operational detail is that many attacks now exploit known vulnerabilities extremely quickly, which shortens the window suppliers and buyers have to coordinate patches and incident response. Watch whether vendors shorten quote validity or change mobilisation and SLA language in response

Why the category manager should care

Treat compressed exploit timelines as a contract and mobilisation issue: require faster evidence exchange, defined remediation roles and rollback obligations

Key facts

• Median exploit window reportedly collapsed from years to hours for a growing share of cases
• High share of attacks now exploit known vulnerabilities rapidly

What happened

A practical example shows an AI agent opening dozens of automated changes across repositories and causing authentication failures and regional outages. The concrete operational detail is that agents can act across multiple systems without human oversight, so governance, a single source of truth and human-approval gates are required to prevent widespread disruption. Watch for regulatory attention and supplier resistance to addenda that limit autonomous changes

Why the category manager should care

Require that suppliers run agents inside governed workflows with audit trails and human-in-the-loop gates

Key facts

• Example where an agent opened dozens of pull requests across multiple repositories
• Resulting regional authentication and access failures after autonomous changes

What happened

Coverage on post-quantum cryptography warns organisations that PQC risk is already operational because national guidance flags algorithm deprecation deadlines. The most important detail is that without visibility into where cryptography is used (a component bill of materials), migration effort will be compressed and costly; suppliers' PQC roadmaps should be validated. Watch vendor product roadmaps and whether suppliers offer PQC support as part of lifecycle updates

Why the category manager should care

Insist on cryptographic inventories and supplier commitments to PQC migration timelines as part of procurement

Key facts

• Government guidance signalling deprecation of widely used cryptographic algorithms
• Advice that long-lived confidentiality needs make PQC a present planning requirement

What happened

NiCE expanded a multi-year reseller and co-selling arrangement with RingCentral to resell unified communications alongside contact-centre products. The operationally relevant detail is that the tie-up increases integrated offers that merge internal communications and customer-facing systems under joint commercial arrangements. Watch contract terms that allocate incident responsibility and whether SLAs and escalation maps are explicit between the two vendors

Why the category manager should care

Treat bundled UCaaS/contact-centre offers as integrated delivery that needs explicit uptime, integration tests and escalation mapping

Key facts

• Multi-year reseller expansion to resell UCaaS alongside contact-centre technology
• Extension of a decade-long commercial relationship between the vendors

What happened

A thematic piece recommends using telemetry and intelligence to extract more value from legacy infrastructure rather than expensive full replacement. The concrete procurement detail is that these projects require suppliers to deliver consistent telemetry, integration work and proof-of-value milestones. Watch for vendor upsell of analytics and staged-delivery proposals where replacement budgets are constrained

Why the category manager should care

Prioritise supplier capability to deliver telemetry, integrations and visible SLAs over promises of full replacement

Key facts

• Shift toward intelligence-led maintenance and performance improvements over wholesale replace
• Emphasis on connecting legacy systems with telemetry and analytics layers