Reassess AI Access, Key Management and Device Compliance in Procurement

What happened

SecurityBrief reports AI has moved from pilots into core processes and infrastructure, and organisations report AI involvement in a high share of recent security incidents. The Gigamon survey cited higher breach rates and longer investigations, making lack of visibility and data-in-motion controls an operational problem. Watch whether suppliers publish concrete telemetry and observability features buyers can require in contracts

Why the category manager should care

Treat AI expansion as an operational access vector that needs contractual telemetry and verification because lack of visibility materially lengthens incident response

Key facts

• Gigamon survey: a sizeable share report integrated AI security practices
• Reported climb in breach rates and longer incident investigation timelines
• High proportion of organisations noting AI involvement in recent incidents

What happened

SecurityBrief highlights that AI tools let attackers accelerate reverse engineering of patches and craft more convincing social-engineering attacks. The reporting flags that organisations receive very large alert volumes and often fail to investigate many of them, making basic hygiene like identity and misconfiguration fixes still critical

Why the category manager should care

Prioritise procurement of tools and services that reduce false positives and automate safe rollback because high alert volumes will otherwise overwhelm SOC capacity

Key facts

• AI enables attackers to weaponise patches and compose attacks faster
• Research notes very high alert volumes with a majority uninvestigated
• Vendor guidance emphasises identity and misconfiguration fixes over hype solutions

What happened

Google Cloud previewed quantum-safe key import for Cloud Key Management Service to support BYOK deployments with post-quantum encapsulation options. The feature targets transit risk where captured key material today could be decrypted later, and offers specific algorithm choices buyers will need to validate for their libraries and workflows

Why the category manager should care

Treat quantum-safe key import as a procurement requirement for regulated or high-value data because it changes how BYOK transit risk is mitigated

Key facts

• Preview feature for quantum-safe key import in Cloud KMS for BYOK scenarios
• Supports specific post-quantum key encapsulation algorithm options for import
• Targets transit risk from store-now, decrypt-later attacks

What happened

SecurityBrief explains that home batteries and inverters are now explicitly captured by Australia's Cyber Security Act and related rules, making them regulated networked devices. The practical effect is that millions of already-installed units may need certification, and suppliers or installers with write access become third-party integration risks to organisations operating sites with such hardware

Why the category manager should care

Treat on-site energy hardware as a security-controlled category requiring proof of compliance and clear supplier remediation responsibilities because these devices can affect grid stability and create attack surfaces

Key facts

• Installed base means compliance is a catch-up exercise, not just for new purchases
• Third-party integrations with write access are singled out as a meaningful operational risk