Force Identity Controls and Reassess Vendor Evidence for AI Risk

What happened

Singapore's former Cyber Security Agency chief warned that AI is compressing attack timelines from weeks to minutes, making traditional periodic assessments insufficient. The piece highlights identity governance as the control that must change—scoped access, time-limited credentials and continuous monitoring are now operational necessities. Watch whether organisations publish specific timelines or tooling commitments for non-human identity revocation

Why the category manager should care

Treat identity controls as a contract deliverable and acceptance gate, not just an operational best practice

Key facts

• AI compresses attack timelines from weeks/months to minutes
• Recommendation: continuous surveillance over annual assessments
• APAC manufacturing noted as highly targeted due to extended supplier chains

What happened

Check Point's July data shows a continued rise in weekly cyberattacks and highlights that enterprise GenAI use produces frequent high-risk prompts that can leak sensitive material. The report gives concrete telemetry (attack volumes and risky prompt incidence) that operations can test against; buyers should watch vendor controls for prompt logging and data-masking

Why the category manager should care

Evaluate suppliers on how they control and log GenAI prompts where automation touches sensitive data, not just on general AI statements

Key facts

• Average weekly cyberattacks per organisation reported in July
• Enterprises used an average of eight GenAI tools; average user generated 95 prompts in July
• One in 36 prompts carried a high risk of sensitive data leakage

What happened

Quest Software has achieved IRAP assessed status for two of its platforms, covering OFFICIAL and PROTECTED workload levels used by Commonwealth agencies. That assessment reduces the need for individual agency security reviews for those products and can materially shorten procurement cycles for buyers who accept the assessor evidence

Why the category manager should care

Use assessor evidence to streamline buys for assessed products, but verify scope and deliverables match your intended use

Key facts

• IRAP assessed status covers PROTECTED workloads and OFFICIAL/PROTECTED classifications
• Assessment is against the Australian Government Information Security Manual via the Infosec R
• Assessment removes a common lengthy review step for government buyers