Recalibrate Vendor Controls for AI-Accelerated Ransomware and Automation

What happened

Proofpoint's research finds AI materially increases ransomware effectiveness in Australia, with many victims reporting data theft and a substantial share facing repeat extortion after paying. The study sampled security professionals and shows phishing and email-based social engineering remain primary entry points. Watch whether payment patterns or regulatory reporting change buyer exposure to second-extortion demands

Why the category manager should care

Treat ransomware as a multi-stage commercial risk: initial disruption plus likely data-theft negotiations and possible repeat extortion, all of which expand supplier and contractual obligations

Key facts

• Survey of security professionals including Australian respondents
• High share of victims reported data theft during incidents
• Significant portion experienced a second extortion demand after paying

What happened

Tech Mahindra and Cisco announced a joint AI-driven Security Service Edge (SSe) offering combining managed services with Cisco's Secure Access platform. The partnership bundles access control, cloud security, zero-trust access and data loss prevention into a single managed framework aimed at hybrid and distributed work environments. Procurement should watch onboarding, data access, and contract scope when evaluating similar platform partnerships

Why the category manager should care

This is a signal that large suppliers will push platform-managed models; treat these as outsourcing deals that require mobilisation, exit, and evidence clauses

Key facts

• Joint managed SSe service combining Tech Mahindra managed services and Cisco Secure Access
• Includes secure web gateway, cloud access broker, zero-trust network access and DLP
• Aimed at hybrid work and cloud migration customers

What happened

Fleet Device Management research shows many IT leaders are prioritising AI-driven automation over infrastructure-as-code (IaC) foundations, while endpoint-management remains only partly automated in most organisations. The gap means fewer buyers may require version-controlled deployment artifacts, increasing the risk that automated changes lack rollback and auditability. Watch whether RFPs and SOWs continue to accept limited deployment governance when selecting AI tooling

Why the category manager should care

If suppliers are not required to deliver IaC or equivalent artifacts, buyers lose reproducibility, rollback, and auditability — all critical when agents or AI-driven changes are in play

Key facts

• Survey of enterprise IT leaders on investment priorities
• Large share rank AI-driven automation above infrastructure-as-code
• Many organisations report limited endpoint automation and slow patching timelines

What happened

SecurityBrief reports that many mid-market Australian companies default to buying more cybersecurity tools while lacking a dedicated cyber leader, such as a chief information security officer. This behaviour often leaves buyers able to list tools but not business outcomes, so purchases may not reduce exposure to payment fraud or payroll compromise. Watch whether procurement teams start to demand governance roles or outcome-based SLAs in deals

Why the category manager should care

Treat purchases as governance and outcome contracts — require supplier evidence they support business controls, not just product feature lists

Key facts

• Mid-market buyers commonly list tools rather than business outcomes when discussing cyber risk
• CFOs frequently sign off on product purchases that fit budget line items
• Operational risks include potential payment redirection and access to payroll/customer data

What happened

Coverage indicates an 'AI arms race' is forcing organisations to automate cyber hygiene and accelerate patching because AI shortens the time between vulnerability disclosure and exploitation. The primary operational effect is a near-zero window for manual remediation, pushing buyers toward automation and better patch orchestration. Watch whether suppliers offer automated patching with rollback or simply sell additional monitoring tools

Why the category manager should care

Prioritise suppliers that provide automated, auditable patching and rollback capabilities because manual windows are shrinking rapidly

Key facts

• Industry commentary on shrinking time-to-exploit driven by AI
• Organisations accelerating automation of cyber hygiene and patching
• Executive-level debate over governance and funding for agentic rollouts