Strengthen Contracts and Controls for AI-Driven OT and Identity

AI reading

Claroty launched Claire, an AI security agent targeted at cyber-physical systems (OT, industrial control and medical devices). The product is trained on a decade of sector data and thousands of device makers, and the vendor positions it to move teams from asset discovery to remediation and compliance. Watch whether Claroty’s automation is paired with contract terms for operator approvals, rollback and remediation billing

Buyer takeaway

Treat Claroty’s launch as operational: automation can speed remediation but must be contractually constrained with human approvals and rollback rights

Cost / money

Directional: automation can reduce manual triage cost but may introduce new integration, validation and remediation pass-throughs if contracts don’t limit supplier charging

Supplier / commercial

Suppliers will seek pilot and managed-remediation terms; expect narrow quotes and timing pressure for OT support unless SOWs limit short-notice premium scopes

Safety / operations

Operational risk increases if AI suggests live changes without approved rollback and change-control gates; production uptime must be preserved in SOWs

What to watch

Watch for vendors advertising automated remediation without priced rollback or operator-gating clauses; demand explicit verification and dispute clauses

Key facts

• Trained on more than a decade of CPS sector work
• Draws on data covering 6,500 OEMs and device manufacturers
• Vendor cites deployments across 20,000 sites in 60+ countries

Source excerpts

Used in this brief

• Next 72 hours — Tag suppliers in the register with 'CPS/OT AI', 'DPUs/infra enforcement', and 'Vulnerability orchestration' capability flags.. Rationale: Do this because Claroty’s Claire and Akamai/NVIDIA announcements make these capabilities material to sourcing decisions and we need to surface current exposure before shortlist.... Owner: Category. KPI: Supplier register shows capability flags to inform immediate shortlists and risk reviews
• Next 2-4 weeks — Update RFx and SOW templates to require human-in-the-loop controls, priced rollback clauses, SOC integration statements, and remediation-billing clarity for CPS/OT and vulnerabi.... Rationale: Do this because Claroty and HackerOne demonstrate automated remediation and orchestration capabilities that must be contractually bounded to protect uptime and cost predictability.. Owner: Contracts. KPI: RFx/SOW templates include scored requirements for operator approval, rollback, SOC handoffs and remediation billing responsibilities
• Watch for vendors selling 'automated remediation' without priced rollback, operator approval or clear liability — early-signal that contract language must require verification and dispute resolution for AI-suggested changes

AI reading

Akamai and NVIDIA expanded a security integration to enforce workload-aware segmentation using NVIDIA BlueField DPUs and the DOCA platform. The integration moves enforcement into infrastructure silicon, promising policy enforcement without host agents and targeting AI workloads and high-performance environments. Buyers should map which suppliers will resell or support the required DPUs and confirm availability and support windows

Buyer takeaway

This is operationally real: enforcement moving into DPUs means procurement must cover hardware, partner resellers and firmware/support SLAs, not just software licenses

Cost / money

Costs may shift to capital or managed-service pass-throughs for DPUs and partner integrations if not unbundled in contracts

Supplier / commercial

Vendors and partners may bundle enforcement silicon with support; buyers should push for unbundled pricing and clear activation SLAs to retain negotiating leverage

Safety / operations

In-fabric enforcement reduces host load but increases dependency on infrastructure availability and partner firmware updates; include maintenance windows and rollback plans

What to watch

Watch partner availability and staggered release timelines that could vary regionally; verify reseller support commitments before contractual acceptance

Key facts

• Integration enforces segmentation in infrastructure fabric via NVIDIA DOCA
• Availability expected H2 2026, partner platforms H1 2027
• Targets AI factories, data centres, cloud and edge environments

Source excerpts

Used in this brief

• Supplier / commercial: Infrastructure vendors (Akamai/NVIDIA partners) may bundle enforcement silicon with platform support — buyers should negotiate unbundled pricing or explicit activation and support SLAs to retain leverage
• Next 2-4 weeks — Inventory infrastructure and managed-network contracts to identify exposure to enforcement silicon (DPUs/BlueField) and any partner-resold bundles.. Rationale: Do this because the Akamai–NVIDIA integration shifts enforcement into hardware and partner platforms, which can change support, pass-through pricing and exit obligations if not.... Owner: Ops. KPI: Prioritized list of contracts with DPU/enforcement exposure and recommended negotiation levers
• Watch whether infrastructure enforcement is resold through partners with varying support models; buyers should verify vendor integration timelines and partner support terms before accepting bundled offers

AI reading

HackerOne launched the H1 Platform, an AI-based orchestration product that links vulnerability discovery, validation and remediation routing into development workflows. The platform uses an AI orchestrator and integrates with tools like Jira, GitHub and ServiceNow to reduce triage time and push validated findings into ticketing. Buyers need to validate remediation SLAs and whether the platform introduces new managed-remediation costs or changes who pays for fixes

Buyer takeaway

Operationally, the platform changes who routes and validates findings; buyers must define SLAs and billing responsibility for validated remediation work

Cost / money

Potential to reduce manual triage costs but may move spend to platform subscription or managed-remediation fees if vendors offer end-to-end services

Supplier / commercial

Vendors may push integrated platform deals that lock in orchestration; negotiate integration and exit terms to avoid vendor lock-in and unpriced remediation

Safety / operations

Faster validation reduces exploit windows but rely on accurate triage; include quality KPIs and escalation paths to avoid missed critical fixes

What to watch

Watch claims of dramatic MTTR improvements without corresponding contractual SLAs on false positives, triage accuracy and remediation ownership

Key facts

• Platform integrates with Jira, GitHub, ServiceNow and DevOps tools
• HackerOne cites use by 1,300 organisations and claims reduced triage time materially
• Vendor reports vulnerability submission volumes rising rapidly

Source excerpts

Used in this brief

• Cost / money: Vulnerability orchestration that routes findings into dev workflows (HackerOne) can reduce triage time but may expose buyers to remediation pass-through charges or require change in headcount allocation to consume validated findings
• Next quarter — Pilot ingesting an integrated vulnerability-orchestration stream (HackerOne H1 or equivalent) into the dev ticketing and CI pipeline to validate SLAs, triage quality and remedia.... Rationale: Do this because HackerOne’s H1 Platform promises faster validated findings but buyers must verify developer throughput, false-positive rates and any supplier charges for managed.... Owner: Ops. KPI: Pilot validates end-to-end remediation handoff, produces contract change recommendations and clarifies operational headcount impacts
• Added HackerOne H1 Platform (article 5) which reframes vulnerability management as an integrated discovery-to-remediation service

AI reading

XM Cyber expanded identity exposure management to show detailed permissions usage across Active Directory, Entra and cloud platforms to help enforce least-privilege. The update links over-permissioned accounts to actual usage patterns so teams can prioritize removals without disrupting operations. Buyers should check integration effort and whether this overlaps existing IAM investments

Buyer takeaway

This is operationally useful for shrink-wrapping remediation effort, but buyers must verify integration and avoid duplicate licensing with existing IAM tools

Cost / money

May reduce manual review effort but could require new licensing or integration spend to feed permissions telemetry into IAM workflows

Supplier / commercial

Vendors will seek to upsell identity intelligence as a managed capability; insist on clear delineation between visibility and managed remediation billables

Safety / operations

Better visibility reduces lateral-movement risk if remediation is coordinated; include runbooks for removing access without disrupting services

What to watch

Limited relevance if existing IAM tooling already provides comparable usage telemetry; verify overlap before procurement

Key facts

• Adds permissions-usage visibility across Active Directory, Entra and cloud platforms
• Designed to reduce excessive-permission attack paths and guide remediation
• Positions identity intelligence as part of continuous exposure management

Source excerpts

Used in this brief

• Next 2-4 weeks — Validate identity and permissions tooling integrations (Active Directory/Entra/cloud) against XM Cyber’s new features to confirm the vendor will not create blind spots or duplic.... Rationale: Do this because XM Cyber’s permissions-usage analysis can change remediation ownership across IT, security and DevOps teams and may require license or integration work.. Owner: Category. KPI: Integration gap report that maps where XM Cyber features replace or augment existing IAM controls
• XM Cyber expanded identity exposure management to show detailed permissions usage across Active Directory, Entra and cloud platforms to help enforce least-privilege. The update links over-permissioned accounts to actual usage patterns so teams can prioritize removals without disrupting operations. Buyers should check integration effort and whether this overlaps existing IAM investments
• Buyer bottom line: Improved permissions-usage visibility can reduce lateral-movement risk but requires coordination with IAM and DevOps to avoid duplicated effort or license waste

AI reading

Asimily launched segmentation orchestration to convert device risk intelligence into network policy, working with existing NAC and firewall systems. The product automates inventory, policy simulation, creation and continuous segmentation to reduce manual translation errors that often delay enforcement. Test conservative simulation and phased rollouts to avoid interrupting critical device traffic in healthcare or manufacturing

Buyer takeaway

Operationally meaningful: automation closes the gap between detection and enforcement but needs conservative simulation and compatibility checks with existing NAC/firewall stacks

Cost / money

Can lower manual policy engineering costs but may require integration services and ongoing tuning effort paid to supplier or partners

Supplier / commercial

Vendors will propose low-effort enforcement; insist on proof-of-value tests and rollback clauses to limit operational disruption liability

Safety / operations

Incorrect policies can break patient monitoring or production flows; require staged deployment, simulation reports and operator approval gates

What to watch

Limited relevance if the enterprise already has mature NAC segmentation workflows; run pilot tests before wide procurement

Key facts

• Covers inventory, vulnerability prioritisation, policy simulation, creation and continuous se
• Maps ports, protocols and service dependencies before policy creation
• Designed for IT, OT, IoMT and IoT device estates

Source excerpts

Used in this brief

• Safety / operations: Automated segmentation and device-policy orchestration reduce manual error but can disrupt production if policy simulation and conservative deployment gates are not enforced in contracted delivery plans
• Next quarter — Run a controlled test of segmentation-orchestration tooling (Asimily) against a non-production device group to confirm policy simulation, conservative deployment gates and firew.... Rationale: Do this because Asimily automates translating device risk into policies and we must avoid misapplied segmentation that could interrupt patient monitoring or production.. Owner: Ops. KPI: Test report showing simulation accuracy, integration gaps, and recommended deployment guardrails before full roll-out
• Added XM Cyber identity enhancements (article 3) and Asimily segmentation orchestration (article 7) to the device/identity automation story; Claroty (article 2) was previously flagged and remains relevant