Strengthen Telecom, Cloud and Device Controls After New Signals

What happened

A cyber sweep found Royal Navy drone cameras sending a heartbeat signal to an IP address in China. The MoD says no data was accessed, but the unexpected outbound telemetry came from a Kraken unmanned surface vessel sub-system and prompted an investigation. Operationally, buyers should require telemetry endpoint mapping and independent testing during acceptance; watch whether the supplier discloses firmware and endpoint details

Why the category manager should care

Do not accept supplier assurance alone; require demonstrable telemetry maps and test windows for embedded subsystems as part of acceptance

Key facts

• Outbound camera telemetry observed to an IP address in China
• Discovery made during a routine cyber vulnerability assessment
• Subsystem implicated: Kraken unmanned surface vessel camera

What happened

DEF CON’s Franklin project and the National Rural Water Association launched the Water Watch Center to fund MSSPs and tools for small water utilities. The program initially backs five providers to exchange threat data and provide operational assistance for understaffed utilities. Procurement should view these MSSPs as potential partners for underserved sites but validate SLA scalability and playbooks before formal onboarding

Why the category manager should care

Pilot MSSP arrangements can extend coverage quickly, but require explicit SLAs, escalation paths, and operational handover commitments

Key facts

• Initial funding for five MSSPs with planned expansion
• Focus on small utilities with limited staff
• Includes threat information exchange with NRWA

What happened

Alibaba Cloud published a DualLane system that routes support tickets away from large language models when a faster, cheaper path suffices and has put the system into production. The fast path uses minimal token expense while the slow path handles complex cases and can use many tokens. Buyers should ask cloud suppliers how AI routing impacts support SLAs, visibility, and billed AI consumption

Why the category manager should care

Ask suppliers to disclose when and how AI is used in support workflows and how that maps to pricing and SLA measurements

Key facts

• DualLane routes simple tickets to a fast path and complex cases to a slow LLM path
• Slow path can use up to 3,000 tokens for complex handling
• Alibaba reports production deployment with high accuracy in benchmarks

What happened

Researchers demonstrated that malicious SIMs can abuse standard SIM functions to run AT commands, downgrade connections, execute code, and extract files from phones and IoT modems. The team tested multiple devices and noted vendor patches and industry tracking are underway. Procurement must treat SIM-originated command interfaces as a specification item and require vendor mitigations and patch commitments

Why the category manager should care

Treat SIM-originated command capability as a real procurement vulnerability and require technical mitigations (disable AT interface, firmware patches) in supplier contracts

Key facts

• Tests covered multiple smartphones and IoT modems with several vulnerabilities found
• Demonstrated attacks: code execution, file reads, and connection downgrades
• Vendors and standards bodies responding: patches and GSMA tracking

What happened

OVH warned of large component price increases and said it will raise instance prices while decoupling storage and IP into separate billed items, and is changing some saving-plan offerings. The company cited multi-fold increases in memory and NVMe pricing as drivers. For procurement, this is a signal to re-examine renewal clauses, line-item billing, and negotiate price-protection or pass-through limits

Why the category manager should care

Treat vendor cost notices as a trigger to review renewals and pass-through exposure, and negotiate price-protection terms where possible

Key facts

• Vendor cites multi-fold jumps in memory and NVMe prices
• Decoupling storage and IP from Gen3 instances into separately billed items
• Changes to saving-plan offerings affecting shorter-duration discounts