Prioritise AI Governance, Identity, and Patch Controls in Sourcing

What happened

CrowdStrike introduced an AI Partner Specialisation within its Falcon partner program and launched a Verified Agent certification for partner‑built AI agents. The programme ties identity verification (CLEAR) and OT security alliances into detection workflows and is available for existing CrowdStrike and CLEAR customers to activate. Watch partner certification scope, marketplace terms and whether partners start building paid integration tiers that change who does implementation and incident support

Why the category manager should care

Treat the programme as a channel shift: certified partners may own integration and operational responsibilities that used to sit with the vendor

Key facts

• AI Partner Specialisation within the CrowdStrike Accelerate program
• Verified Agent certification for partner‑built AI agents
• Integration available for existing CrowdStrike and CLEAR customers

What happened

CISA released a vulnerability review showing a large share of exploited flaws map to long‑known, avoidable software weaknesses such as command injection and hard‑coded credentials. The report highlights that organisations still miss recommended remediation timelines and that the KEV catalogue has continued to grow. Procurement should require secure‑SDLC evidence and clear patch/KEV remediation commitments from suppliers and test their deployment pipelines where possible

Why the category manager should care

This reflects a systemic supplier‑quality gap: insist on demonstrable secure‑SDLC artefacts and patching SLAs in procurements

Key facts

• Large share of exploited vulnerabilities map to long‑understood weakness categories
• KEV catalogue size increased above prior trends
• Critical categories include command injection, path traversal and hard‑coded credentials

What happened

Airrived launched a Sovereign AI Platform that runs agentic AI on‑premises, on private GPUs, or in air‑gapped environments and bundles agent orchestration, models and infrastructure control. The product is aimed at governments and regulated enterprises and positions itself as an alternative to externally hosted AI for customers with strict data handling needs. Procurement should treat these offers like infrastructure buys and request detailed runbooks, GPU lifecycle plans and recovery procedures before committing

Why the category manager should care

Operational control is real but carries infrastructure and runbook obligations—validate runbooks and lifecycle responsibilities before choosing on‑prem

Key facts

• Supports on‑prem, private GPU and air‑gapped deployments
• Includes an Agentic OS for agent orchestration and pre‑built agent applications
• Targets governments, critical infrastructure and regulated enterprises

What happened

Microsoft published its Responsible AI Transparency Report updating its Responsible AI Standard to separate controls for models, platform services and applications and to focus on systems that retain memory or act agentically. The company described expanded testing, monitoring and an external red‑team programme to stress priority risks. Use Microsoft's updated standards as a baseline when asking vendors for testing evidence and monitoring outputs during procurement

Why the category manager should care

Vendor governance maturity is an effective procurement filter—demand testing, monitoring and failure‑mode documentation

Key facts

• Reworked Responsible AI Standard separating models, platform services and applications
• Focus on systems that retain memory, use tools or behave agentically
• Expanded external red‑team collaboration and monitoring practices

What happened

Building approvals tied to data centres have risen and are lifting non‑residential approvals in Australia, signalling continued demand for digital infrastructure construction. The trend can keep pressure on labour, materials and contractor availability for infrastructure projects in the region. Procurement should factor potential schedule and cost pressure into sourcing and contract terms for new builds or colocations

Why the category manager should care

Treat construction activity as a supply‑chain pressure point for infrastructure sourcing and scheduling

Key facts

• Non‑residential approvals driven upward by data‑centre projects
• Stronger commercial pipeline likely to affect labour and material availability
• Implication: potential schedule and cost pressure for new infra and colo projects