Intelligence Hub | Category Market Intelligence

Decision at a glance

Top move

Openreach is widening stop-sell for copper services, creating contract and migration exposure for buyers and their suppliers; providers are being charged higher rental rates for legacy lines which will shift commercial pressure onto customers and MSP partners

Key takeaways

Openreach is widening stop-sell for copper services, creating contract and migration exposure for buyers and their suppliers; providers are being charged higher rental rates for legacy lines which will shift commercial pressure onto customers and MSP partners.[1]
A recent Microsoft Defender for Endpoint Linux update disabled the security service on some systems after reboot or blocked installation on hardened RHEL in FIPS mode — this is an immediate operational patch/backout and third-party agent dependency problem for fleets that run Linux endpoints.[5]
Vendors are pushing agentic AI into networking and security operations (Cisco Cloud Control for network ops; Microsoft’s Project Perception and security-specialized models) — expect vendor proposals to shift spend toward model hosting, tokens, or managed services and to create new execution dependencies.[2]

Why this matters for the category manager

Openreach is widening stop-sell for copper services, creating contract and migration exposure for buyers and their suppliers; providers are being charged higher rental rates for legacy lines which will shift commercial pressure onto customers and MSP partners. A recent Microsoft Defender for Endpoint Linux update disabled the security service on some systems after reboot or blocked installation on hardened RHEL in FIPS mode — this is an immediate operational patch/backout and third-party agent dependency problem for fleets that run Linux endpoints. Vendors are pushing agentic AI into networking and security operations (Cisco Cloud Control for network ops; Microsoft’s Project Perception and security-specialized models) — expect vendor proposals to shift spend toward model hosting, tokens, or managed services and to create new execution dependencies. An industry coalition (Open Secure AI Alliance) formed to promote open-weight models; procurement should expect vendor narratives that position open models as a security and sovereignty advantage, which will affect hosting and support requirements in RFPs

What changed

Added telco infrastructure change (Openreach stop-sell expansion) that directly affects copper-dependent contracts; not present in prior brief.
Added an active endpoint regression (Defender for Endpoint on Linux) that requires immediate fleet validation and rollback planning.
Captured vendor activity pushing agentic AI into network and security operations (Cisco, Microsoft) and a formal industry alliance promoting open models — these shift sourcing focus from pure licensing to execution de...

Category impact

Cost / money

Openreach is passing higher rental costs onto providers that continue selling legacy copper services; buyers relying on legacy access risk higher recurring connectivity charges or forced migration costs.[1]
Vendors pitching agentic AI claim reduced operational costs but shift spend into model hosting, token consumption, or managed-service fees — procurement should expect different cost buckets (platform/compute vs. headcount) in proposals.[3]

Supplier / commercial

Stop-sell rules tighten negotiation windows with access carriers and last-mile suppliers; contract clauses on migration timelines, inventory access, and pass-through charges will become leverage points.[1]
Cisco’s near-release on-prem AI models create a hosting-choice inflection: suppliers may propose higher-value on-prem licenses or managed hosting that change commercial mix and billing models.[2]
The Open Secure AI Alliance will give suppliers a public platform to promote open-weight offerings and support bundles; expect new commercial packaging and potential bundling of model-support services.[4]

Safety / operations

A Microsoft Defender for Endpoint update can disable endpoint protection after reboot or fail installation on hardened RHEL — operations must treat updates as potential blockers to uptime and validate rollback paths before broad rollout.[5]
Agentic AI that recommends or executes network actions (reboots, config changes) increases blast radius of automation; change-control and staged testing are required to preserve availability and incident response posture.[2]

What to watch

Watch whether Openreach’s stop-sell cadence accelerates retirements or forces more aggressive migration offers from suppliers — this will affect lead times and migration cost allocations.[1]
Vendor performance claims for agentic security models (benchmark and cost claims) come from supplier tests; independent validation is needed before re-allocating SOC or tooling budgets based on those claims.[3]

Category manager actions

Action detail for this brief

Today's priorities

Inventory Linux endpoints running Microsoft Defender and identify systems on affected builds and RHEL FIPS configurations.

because Microsoft disclosed a Defender for Endpoint update that can disable the service or block installs on hardened RHEL, and knowing where the risk lives lets Ops target roll...

Due 3d

high

Flag all active contracts that depend on copper-based access and open a commercial review with carriers and MSPs.

because Openreach is expanding stop-sell and adjusting charges for legacy products, and early contract review preserves leverage to negotiate migration timing or cost pass-throu...

Due 3d

high

Require vendor proposals for agentic AI or on-prem models to include execution-authority clauses, explicit blast-radius descriptions, and rollback SLAs.

because Cisco and others are introducing agentic tooling that can perform network or endpoint actions, and contracts must limit automatic actions and assign rollback responsibil...

Due 21d

high

Supplier radar

theregister

high

Observed supplier signal

Stop-sell rules tighten negotiation windows with access carriers and last-mile suppliers; contract clauses on migration timelines, inventory access, and pass-through charges will become leverage points.

Commercial implication

Stop-sell rules tighten negotiation windows with access carriers and last-mile suppliers; contract clauses on migration timelines, inventory access, and pass-through charges will become leverage points.

Next step: Validate the source-backed signal with incumbents and alternates before the next award or pricing decision.

theregister

high

Observed supplier signal

Cisco’s near-release on-prem AI models create a hosting-choice inflection: suppliers may propose higher-value on-prem licenses or managed hosting that change commercial mix and billing models.

Commercial implication

Cisco’s near-release on-prem AI models create a hosting-choice inflection: suppliers may propose higher-value on-prem licenses or managed hosting that change commercial mix and billing models.

Next step: Validate the source-backed signal with incumbents and alternates before the next award or pricing decision.

theregister

high

Observed supplier signal

The Open Secure AI Alliance will give suppliers a public platform to promote open-weight offerings and support bundles; expect new commercial packaging and potential bundling of model-support services.

Commercial implication

The Open Secure AI Alliance will give suppliers a public platform to promote open-weight offerings and support bundles; expect new commercial packaging and potential bundling of model-support services.

Next step: Validate the source-backed signal with incumbents and alternates before the next award or pricing decision.

Negotiation levers

Lever

Inventory Linux endpoints running Microsoft Defender and identify systems on affected builds and RHEL FIPS configurations.

Use when

because Microsoft disclosed a Defender for Endpoint update that can disable the service or block installs on hardened RHEL, and knowing where the risk lives lets Ops target roll...

Expected outcome

List of affected hosts, current Defender build status, and short-term mitigation flags for patch/backout decision making.

high confidence

Lever

Flag all active contracts that depend on copper-based access and open a commercial review with carriers and MSPs.

Use when

because Openreach is expanding stop-sell and adjusting charges for legacy products, and early contract review preserves leverage to negotiate migration timing or cost pass-throu...

Expected outcome

Prioritized list of contracts with legacy connectivity dependencies and recommended amendment or migration options for negotiations.

high confidence

Lever

Require vendor proposals for agentic AI or on-prem models to include execution-authority clauses, explicit blast-radius descriptions, and rollback SLAs.

Use when

because Cisco and others are introducing agentic tooling that can perform network or endpoint actions, and contracts must limit automatic actions and assign rollback responsibil...

Expected outcome

Standard contract language or addendum that governs automated actions, audit logs, and supplier rollback obligations.

high confidence

Talking points

Openreach is widening stop-sell for copper services, creating contract and migration exposure for buyers and their suppliers; providers are being charged higher rental rates for legacy lines which will shift commercial pressure onto customers and MSP partners.

A recent Microsoft Defender for Endpoint Linux update disabled the security service on some systems after reboot or blocked installation on hardened RHEL in FIPS mode — this is an immediate operational patch/backout and third-party agent dependency problem for fleets that run Linux endpoints.

Vendors are pushing agentic AI into networking and security operations (Cisco Cloud Control for network ops; Microsoft’s Project Perception and security-specialized models) — expect vendor proposals to shift spend toward model hosting, tokens, or managed services and to create new execution dependencies.

Recommended actions

Do now

Inventory Linux endpoints running Microsoft Defender and identify systems on affected builds and RHEL FIPS configurations.
Why: because Microsoft disclosed a Defender for Endpoint update that can disable the service or block installs on hardened RHEL, and knowing where the risk lives lets Ops target roll...
Owner: Ops
Expected outcome: List of affected hosts, current Defender build status, and short-term mitigation flags for patch/backout decision making.
[5]
Flag all active contracts that depend on copper-based access and open a commercial review with carriers and MSPs.
Why: because Openreach is expanding stop-sell and adjusting charges for legacy products, and early contract review preserves leverage to negotiate migration timing or cost pass-throu...
Owner: Category
Expected outcome: Prioritized list of contracts with legacy connectivity dependencies and recommended amendment or migration options for negotiations.
[1]

Next few weeks

Require vendor proposals for agentic AI or on-prem models to include execution-authority clauses, explicit blast-radius descriptions, and rollback SLAs.
Why: because Cisco and others are introducing agentic tooling that can perform network or endpoint actions, and contracts must limit automatic actions and assign rollback responsibil...
Owner: Contracts
Expected outcome: Standard contract language or addendum that governs automated actions, audit logs, and supplier rollback obligations.
[2]
Engage shortlisted suppliers on open-model hosting and support options, and draft template addenda covering model custody and support responsibilities.
Why: because the Open Secure AI Alliance is positioning open models as security tools and suppliers will offer new hosting/support bundles that buyers need to control contractually.
Owner: Contracts
Expected outcome: Template addendum for open-model hosting, custody, and supplier support obligations ready for RFP inclusion.
[4]

Watch

Update sourcing playbooks to mandate connectivity migration timelines, legacy-service pass-through clauses, and endpoint update/rollback SLAs for security agents.
Why: because stop-sell policies, endpoint update regressions, and agentic AI releases together increase execution dependency across connectivity, endpoint security, and vendor-manage...
Owner: Category
Expected outcome: Revised sourcing playbook with required migration clauses, pass-through protections, and update/rollback SLAs to include in RFPs and renewals.
[1]

What to watch

Watch whether Openreach’s stop-sell cadence accelerates retirements or forces more aggressive migration offers from suppliers — this will affect lead times and migration cost allocations
Vendor performance claims for agentic security models (benchmark and cost claims) come from supplier tests; independent validation is needed before re-allocating SOC or tooling budgets based on those claims
Watch whether Openreach’s stop-sell cadence accelerates retirements or forces more aggressive migration offers from suppliers — this will affect lead times and migration cost allocations.: Watch whether Openreach’s stop-sell cadence accelerates retirements or forces more aggressive migration offers from suppliers — this will affect lead times and migration cost allocations
Vendor performance claims for agentic security models (benchmark and cost claims) come from supplier tests; independent validation is needed before re-allocating SOC or tooling budgets based on those claims.: Vendor performance claims for agentic security models (benchmark and cost claims) come from supplier tests; independent validation is needed before re-allocating SOC or tooling budgets based on those claims
Openreach is widening stop-sell for copper services, creating contract and migration exposure for buyers and their suppliers; providers are being charged higher rental rates for legacy lines which will shift commercial pressure onto customers and MSP partners
A recent Microsoft Defender for Endpoint Linux update disabled the security service on some systems after reboot or blocked installation on hardened RHEL in FIPS mode — this is an immediate operational patch/backout and third-party agent dependency problem for fleets that run Linux endpoints
Vendors are pushing agentic AI into networking and security operations (Cisco Cloud Control for network ops; Microsoft’s Project Perception and security-specialized models) — expect vendor proposals to shift spend toward model hosting, tokens, or managed services and to create new execution dependencies
An industry coalition (Open Secure AI Alliance) formed to promote open-weight models; procurement should expect vendor narratives that position open models as a security and sovereignty advantage, which will affect hosting and support requirements in RFPs

Founding members include Nvidia, Microsoft, Red Hat, HPE, IBM, Adobe, Palantir, SpaceXAI, Hug
Alliance message centers on open-weight models as essential defensive tooling
Formed in response to recent interoperability and security incidents involving models

Market pulse

Index	Latest	Change	As of
Palo Alto (PANW)	320	+0.00 (+0.00%)	Jul 28, 2026, 10:07 AM
CrowdStrike (CRWD)	285	+0.00 (+0.00%)	Jul 28, 2026, 10:07 AM
Zscaler (ZS)	195	+0.00 (+0.00%)	Jul 28, 2026, 10:07 AM
Fortinet (FTNT)	72	+0.00 (+0.00%)	Jul 28, 2026, 10:07 AM

Palo Alto: Agentic security tools and endpoint regressions increase demand signals for next-gen network and endpoint security vendors; consider supplier capacity and managed-service options
Fortinet: Connectivity retirements and endpoint vulnerabilities highlight the need for layered network security and firewall/vendor-managed detection; procurement should validate vendor SLAs and emergency support terms

Evidence and sources

Inline citations jump here. Expand a source to read stored evidence excerpts.

[1] Openreach nudges another 112 exchange areas toward full fiber

theregister.com · Jul 28, 2026

Original linkExpand

Source excerpts

"We are passing those costs on to providers who continue to sell legacy products

At addresses where FTTP is available, providers will no longer be able to sell legacy copper products

"We are passing those costs on to providers who continue to sell legacy products. If your business is still on this copper service, you will start to pay a premium for a service that will be switched off," he added

Open original source

[2] Cisco close to releasing more AI models, this time for deep networking ops

theregister.com · Jul 28, 2026

Original linkExpand

Source excerpts

NETWORKS Token costs not quite sorted, but on-prem will be an option Cisco has developed AI models that can solve networking problems and is close to releasing the tools, plus the Cloud Control agentic ops tool that puts its models to work. Cloud Control is Cisco’s attempt to tame console sprawl, but creating a new interface to its product portfolio driven by agentic AI

The service will be included with Cisco’s other products, but the company is yet to finalise pricing plans

Cisco developed its own deep networking AI model to make that sort of thing possible and Sampath told The Register the model will “shortly” appear on Hugging Face, alongside the Antares security models the company recently published. Sampath said the model "understands routing and switching configs" and therefore “solves network problems better than a frontier model

Open original source

[3] Microsoft's solution to AI security: more AI and more acronyms

theregister.com · Jul 27, 2026

Original linkExpand

Source excerpts

4 boost - outperforms Anthropic’s bug-hunting machine Mythos and OpenAI’s powerful standalone models, and costs about half the price of other leading commercial models

“As the models hand off between each other, they are not just able to deliver better performance than all of the other models combined, they do so at 50 percent of the cost

Unsurprisingly, at Redmond’s security event on Monday, execs touted the tech giant’s AI security prowess and introduced a new agentic security system called Project Perception, and also unveiled its first security-specialized model, MAI-Cyber-1-Flash, designed for software vulnerability analysis. Microsoft packed MAI-Cyber-1-Flash, based on Microsoft AI (MAI)’s internally developed MAI-Thinking-1 reasoning model, inside its MDASH bug-hunting harness

Open original source

[4] Tech giants link hands to praise open AI models after OpenAI - Hugging Face attack

theregister.com · Jul 27, 2026

Original linkExpand

Source excerpts

ai and ml The Open Security AI Alliance says the Hugging Face/OpenAI mess proves frontier labs can't be trusted to properly secure sensitive systems In the wake of OpenAI agents attacking Hugging Face, Nvidia has recruited a new posse of partners to promote open source models as the security solution the industry needs. The AI arms dealer announced the foundation, the Open Secure AI Alliance, in a blog post today, describing the mission of the group being “to ensure defenders everywhere have open, frontier tool

”Only open-source AI models, which China leads development on, can fill that role, the OSAA argues, and it’s prepared to counter those who say open models are a threat: Just look at what happened last week and it's readily apparent that closed source models are dangerous too. The Alliance is pooling its efforts to give security pros access to essential open tools

In addition, IBM and Red Hat have released Lightwell, an automated open-source vulnerability remediation platform, while Microsoft has come out with MDASH, a multi-model agentic scanning harness to automate bug discovery and remediation. Those efforts, while not open source themselves, are still a sign that Alliance members “are building an open defense stack,” Nvidia said

Open original source

[5] Microsoft Defender for Endpoint leaves some Linux boxes defenseless after update

theregister.com · Jul 27, 2026

Original linkExpand

Source excerpts

PATCHES One bug disabled the security service on restart, another blocked installation on hardened RHEL systems Not content with broken Windows updates, Microsoft has disclosed two problems with Defender for Endpoint on Linux – one that could disable the security service after a reboot, and another that prevents updates on FIPS-enabled Red Hat Enterprise Linux 8 and 9

After an upgrade or reinstall followed by a reboot, "the Defender service might be disabled on some devices," according to Microsoft. "If you use Defender for Servers (Plan 1 or 2) with Defender for Cloud and have the MDE [Microsoft Defender Endpoint] integration enabled, automatic updates for the MDE

Microsoft Defender for Endpoint on Linux protects server workloads on-premises and in the cloud

Open original source

[6] Palo Alto

finance.yahoo.com · n.d.

Original linkExpand

No stored excerpt is attached to this source.

Open original source

[7] Fortinet

finance.yahoo.com · n.d.

Original linkExpand

No stored excerpt is attached to this source.

Open original source