Harden Identity Controls, Validate IRAP Claims, and Review Edge Strategy

What happened

APAC security leaders warn that AI makes attacks faster and more automated, so annual assessments are no longer enough and identity governance must be continuous. The piece highlights that AI agents, APIs and service accounts act like users and need scoped, time-limited credentials and continuous monitoring. Procurement should watch for supplier requests to maintain persistent non-human access and require time-bound controls in renewals

Why the category manager should care

Treat identity governance as a contract-level control—require time-limited keys, scoped service accounts and automated evidence instead of relying on periodic audits

Key facts

• AI acceleration compresses attacker timelines from weeks to minutes
• Recommendation: continuous surveillance and scope-limited credentials

What happened

Quest Software achieved IRAP assessed status for two platforms, covering OFFICIAL and PROTECTED workloads and aligning to the Australian Government's Information Security Manual. That formally reduces the need for agency-level reassessment and can eliminate a lengthy and costly prequalification step for buyers in government and regulated industries

Why the category manager should care

Prioritise suppliers with assessed status when targeting government work to remove duplicated security review steps and speed approvals

Key facts

• Assessment covers PROTECTED and OFFICIAL classification levels
• IRAP evidence can avoid a separate agency security review that can take much of a year and a

What happened

SUSE is expanding into Australia's industrial edge, AI inference and telco cloud areas, using acquisitions and partner programs to offer a consistent runtime across data centres, cloud and field devices. The company emphasises partner-led delivery and positions itself as a lower-cost alternative to legacy virtualisation for customers moving to containers and Kubernetes

Why the category manager should care

Evaluate SUSE as an option where distributed inference and on‑site processing matter, but compare partner delivery and exit terms before committing

Key facts

• Strategy focuses on industrial edge, telecom cloud and Kubernetes runtimes
• Emphasis on partner/channel-led deployments and migration from legacy virtualisation

What happened

Verifone is launching biometric-enabled payment terminals in Australia that support facial recognition and palm-vein verification as optional customer authentication at checkout. Enrollment is handled through participating providers (merchants, wallets or banks), creating new consented identity profiles that merchants and providers must manage

Why the category manager should care

Treat biometric terminals as a combined hardware+service procurement that requires explicit privacy, consent and lifecycle clauses

Key facts

• Terminals support facial recognition and palm-vein verification
• Biometric option is optional and enrollment is managed by the provider through which the cust