Identity & Access Management

The fair value estimate for Palo Alto Networks has been raised from US$336.70 to US$395.38, a roughly 17% increase in the underlying model, after a wave of analyst price target hikes. RBC Capital, Wells Fargo, BofA, Morgan Stanley and Truist lifted their targets into the low to mid US$400s, citing stronger cybersecurity demand as AI usage expands and customers consolidate spending with larger platforms. Goldman Sachs, Oppenheimer, BTIG and Susquehanna pointed to solid Q4 results and guidance, with broad based strength across firewalls, SASE, observability, identity and AI security modules. On the bearish side, Bernstein and Phillip Securities moved to more neutral stances while still raising targets, and Stephens and UBS described the risk or reward as more balanced with shares near peak valuation levels. The updated model trims the revenue growth assumption to about 17.31% from about 19.09% and the net profit margin outlook to about 13.84% from about 14.51%, while the future P/E rises to about 197.87x from about 164.67x and the discount rate adjusts to about 8.60% from 8.40%.

The Government Pension Fund, or GPF, has signed a memorandum of understanding with the Deposit Protection Agency, Gogolook (Thailand) Company Limited, known as Whoscall, and National ITMX Company Limited, known as NITMX, to strengthen awareness of fraud and digital crime among GPF members and the general public. Mr. Sornphon Tulyasathien, Secretary-General of the GPF Board, said the organisation manages retirement savings for more than 1.2 million members, and that this collaboration is part of the Retirement Academy project. Under the partnership, Whoscall is providing 1.5 million Whoscall Premium Basic licences to GPF members and will jointly develop an e-learning course with its partners. Mr. Sornphon noted that in 2026, about 16,000 GPF members will retire, with average savings of 1.5 million baht per person. Mrs. Piyaporn Phoklin, Deputy Director and Acting Director of the Deposit Protection Agency, disclosed that from mid-2024 to the present, there have been 270 complaints from people deceived by scammers posing as the agency, with elderly victims accounting for 30 to 40 percent, and 24 victims who actually lost money, with losses ranging from a few hundred baht up to 400,000 baht. Mr. Manwoo Joo, Chief Executive Officer of Gogolook (Thailand) Company Limited, said a single scam phone number can make more than 800,000 calls. Mr. Chatchai Dusadeenod, Managing Director of National ITMX Company Limited, said this collaboration will help broaden the fight against digital crime and reduce the number of victims.

European Commission President Ursula von der Leyen said the EU will push for social media restrictions for children under 13 years, with a draft proposal set to be introduced on Thursday. The draft will impose strict age restrictions and verification requirements on social media, video-sharing platforms, app stores, online games, AI companions, and conversational AI chatbots, according to Bloomberg. "No social media under the age of 13. No personal account under the age of 15," von der Leyen said in her annual address on Wednesday, adding that the proposed law would allow 13- and 14-year-olds to have accounts with limited features and parental supervision. Companies that fail to meet the requirements could face fines of up to 6% of their annual sales. The bloc's upcoming rules follow Australia's ban last year on social media for children aged under 16, while individual EU member states have also been looking at setting their own restrictions.

The Ministry of Finance, together with the Ministry of Digital Economy and Society and related agencies, is preparing a National Anti-Fraud Master Plan and laying out four national central systems to link risk data, incident reporting, money-trail tracking and asset freezing, so that agencies can act on the same information immediately instead of keeping data separate and coordinating step by step. Ms. Lalida Periswiwatana, deputy spokesperson for the Prime Minister's Office, said the government is accelerating efforts to cut off the money trails of technology-driven crime, after finding that money movements have become more complex and faster. Where funds once moved mainly through bank accounts, they can now be spread across multiple layers of accounts, withdrawn as cash, converted into digital assets, gold or foreign currency, or moved out of the country within just a few hours, meaning the old coordination approach may not be able to keep up with the money. The four central systems are: first, One Identity, One Risk Level, which links risk data so that financial institutions, telecom operators, digital platforms and law enforcement see the same set of risks in real time; second, a fraud-pattern analytics system that builds an anonymised financial transaction data centre to analyse criminal networks; third, a single-report, single-trail system that combines reports made through the 1441 hotline, financial institutions and the police into one system using a single reference number throughout the process; and fourth, a track-in-time, freeze-fast system that links data to follow money as it moves and issues freeze orders under legal authority, while supporting the return of funds to victims or the lifting of freezes in line with case outcomes. Related agencies will raise KYC, CDD and EDD standards to tighten scrutiny of customers and risky transactions from the outset, to a level comparable with financial centres abroad. The subcommittee on linking financial data to improve the monitoring of suspicious financial transactions, chaired by Deputy Prime Minister and Finance Minister Ekniti Nitithanprapas, has assigned the permanent secretary of the Ministry of Finance, together with related agencies, to speed up the design of the details of all four systems, including data structure, connectivity, responsible agencies and data standards, for completion within 30 days before submitting them to the subcommittee for further consideration.

CrowdStrike CEO George Kurtz is pushing back against calls to slow frontier AI development, arguing the cybersecurity threat investors should worry about is not theoretical or years away. Kurtz said the genie is out of the bottle, pointing to advanced and open-weight models already available, and warned that AI is giving every criminal and lone actor elite execution, potentially letting less-skilled attackers operate with capabilities previously limited to sophisticated cyber groups. His remarks came in response to Anthropic CEO Dario Amodei, who has called for slowing development of advanced AI, with Kurtz arguing that pacing what comes next does not secure what is already here. He proposed treating AI agents as privileged identities with tightly controlled permissions, short-lived credentials and a kill switch, keeping humans involved in high-stakes decisions, and called for closer cooperation between cybersecurity companies and AI developers including Anthropic and OpenAI, offering CrowdStrike's threat intelligence to independent evaluation efforts. The argument arrives as CrowdStrike's business accelerates: fiscal second-quarter revenue rose 26% to $1.47 billion, annual recurring revenue climbed 25% to $5.84 billion, record net new ARR reached $333 million, up 51%, and free cash flow totaled $377 million, while the company raised its fiscal-2027 net-new-ARR growth outlook. CrowdStrike already generates more than $2.29 billion of ARR from customers using Falcon Flex, and investors are watching whether AI-related security concerns translate into measurable platform expansion through net new ARR, Falcon Flex adoption, customer spending on identity and AI security, and free cash flow.

Four major infrastructure vendors have now shipped standalone agent governance products at general availability, a rush that has itself become the signal that agent governance is decoupling from individual platforms to become a category of its own. Okta pushed furthest into new territory with its July 2026 product innovations, shipping Agent-to-Agent Connections at general availability to enable secure multi-agent workflows through temporary runtime tokens that enforce which agents may invoke which others, alongside the Agent Gateway, available as a research release, which sits between agents and the systems they access without requiring code changes. IBM's Think 2026 announcement positioned next-generation watsonx Orchestrate as an agentic control plane, introduced in June on AWS and IBM Cloud, offering runtime policy management, credential health monitoring, and an Agent Access overview across an organization's entire agent estate. Broadcom embedded governance directly into the compute fabric with AgentMinder, unveiled at VMware Explore on August 31 and shipping at general availability bundled into the VMware Private AI Cloud, treating agents as enterprise-grade identities bound to a declared mission, permitted intents, approved tools, and authorized resources. Dataiku made a different architectural bet, with Dataiku Agent Management scanning agents across nine platforms including Microsoft Copilot Studio, Salesforce Agentforce, AWS Bedrock, and Google Vertex to provide a cross-platform control tower for discovery, certification, and audit-readiness. The urgency tracks to two numbers: Menlo Ventures found that 76 percent of AI applications are purchased rather than built internally, and the Cloud Security Alliance reported in February that 84 percent of organizations doubt they could pass a compliance audit focused on agent behavior or access controls.

ServiceNow introduced new AI governance and workflow security tools called AI Control Tower, Context Engine, and Shift Zero. The products are aimed at helping enterprises manage AI agents with integrated identity, context, and cybersecurity controls. ServiceNow is targeting secure automation, access management, and compliance needs as companies expand AI-driven workflows across their operations. ServiceNow runs cloud software that helps large organizations manage digital workflows across departments, and these new AI governance tools plug directly into systems that already handle IT tickets, HR requests, and operational approvals for customers across North America and other global regions.

The Ministry of Finance has joined hands with the Ministry of Digital Economy and Society to prepare four national central systems to link data on suspicious transactions between agencies, so that all sectors see the same set of risk data, and to speed up the tracing and freezing of money trails before funds are withdrawn, converted into digital assets or gold, or transferred out of the country. Dr. Ekniti Nitithanprapas, Deputy Prime Minister and Minister of Finance, in his capacity as chairman of the subcommittee on linking financial data to enhance the monitoring and investigation of suspicious financial transactions, disclosed together with Mr. Chaichanok Chidchob, Minister of Digital Economy and Society, that the subcommittee approved guidelines to upgrade the prevention and suppression of suspicious transactions in two areas: raising KYC, CDD and EDD standards to be on par with the world's leading financial centres, and drawing up a National Anti-Fraud Master Plan, whose core structure comprises four national central systems. These are the Data Sharing with Consent system, which exchanges risk data under consent; the Anonymous Financial Data Bureau, a centre for anonymous financial transaction data; the Case Management system, a national incident-reporting management system based on the principle of report once, one route; and the Financial Investigation and Account Action system for linking data and freezing money trails. The subcommittee has assigned the Permanent Secretary of the Ministry of Finance, together with relevant agencies, to design the details of the data structure, operating systems, connection guidelines, responsible parties, as well as the rules and data standards for all four systems, to be completed within 30 days before being submitted to the subcommittee for further consideration.

Nvidia and CrowdStrike unveiled SafeMind, an agentic cybersecurity system built on Nvidia Nemotron models and technology from CrowdStrike's Cyber Superintelligence Lab, at CrowdStrike's Fal.Con 2026 conference. Nvidia described the architecture as a continuous loop in which offensive and defensive AI systems challenge and improve one another. Nvidia CEO Jensen Huang reinforced the thesis on September 10 at Goldman Sachs' Communacopia + Technology Conference, arguing cybersecurity is a natural successor to AI coding because defensive systems can operate continuously rather than waiting for a human prompt. For CrowdStrike, AI is simultaneously creating a threat and a product opportunity, since attackers can automate vulnerability discovery, phishing, malware development and lateral movement, while CrowdStrike's endpoint and identity telemetry gives its AI agents proprietary context. For Nvidia, cybersecurity creates a potentially attractive inference workload, as security agents may operate continuously across millions of endpoints, generating recurring demand for inference rather than one-time model training. Hedge-fund ownership of CrowdStrike rose to 89 funds in Q2 from 79 in Q1, while Nvidia rose to 285 from 275, and short interest stood at about 2.4% of CrowdStrike's float and 1.2% of Nvidia's float as of August 14.

Yod Chinsupakul, Chief Executive Officer of LINE MAN Wongnai and LINE Pay Thailand, has taken up the post of President of the Thai E-Payment Trade Association, or TEPA, which has more than 30 member service providers. He announced a direction to raise the security of Thailand's electronic payment systems under a cooperation framework to prevent illegal transactions in the financial sector of the Bank of Thailand, of which TEPA is one of 11 participating agencies. The work will be driven through three key principles: elevate, make difficult, and act quickly, covering the raising of screening standards, making it harder to exploit the system for wrongdoing, and speeding up information exchange and system adjustments to keep pace with new forms of threats. TEPA's role in the framework includes raising the screening of both major and sub-merchants, strengthening identity verification of e-money users and electronic fund transferors, linking proactive surveillance data to regulators, and joining forces with the Bank of Thailand and member networks through operational-level working groups and coordinators.

Salesforce announced its Trusted Enterprise AI Harness on September 10, 2026, formalizing the agent governance stack into a single platform. The Harness comprises six core capabilities: Trusted Context, Trusted Agency, Trusted Action, Trusted Governance, Trusted Security, and Trusted Models, anchored by a new AI Control Plane that lets organizations discover and register agents, establish identity and policy, manage lifecycles, evaluate performance, and control costs. The control plane is designed to manage both Salesforce and third-party AI agents, following the recent Claudeforce initiative that made Anthropic's Claude the default reasoning engine across the platform. Rohan Kumar, Salesforce's President and Chief Platform and Engineering Officer, said the Agentic Enterprise won't be defined by which model a company chooses but by the trusted, proprietary context it brings to that intelligence. The Harness is not scheduled for general availability until early fiscal year 2028, which begins in February 2027, and pricing details have not been disclosed.

Mastercard unveiled a Know-Your-Agent initiative with Visa and Ant International on Thursday, aimed at letting merchants trust software that shops on a customer's behalf. Through the Monetary Authority of Singapore-backed BuildFin.ai platform, the companies plan to connect Mastercard Verifiable Intent, Visa's Trusted Agent Protocol and Ant International's Agentic Mobile Protocol, so card networks, digital wallets, marketplaces and AI platforms can identify approved purchasing agents without surrendering control of their own authorization rules. Mastercard handled 47.4 billion switched transactions last quarter and generated $9.28 billion in revenue. AI agents could eventually bring more purchasing activity onto its network, but they also raise the question of who pays when autonomous software authorizes the wrong transaction. Investors still lack an adoption timetable, a defined revenue model and clear rules for allocating losses.

Atsign announced that, working with Intel, it has solved the encryption bottleneck holding back autonomous Edge AI agents, achieving a performance uplift of approximately 88x for hardware-accelerated, end-to-end encrypted Agent-to-Agent communications. The two companies co-published a Smart Transportation Solution Brief titled "Securing Agentic AI at the Edge for Smart Transportation," which details zero-trust Agentic AI benchmarks showing the uplift varies by hardware: roughly 88x on Intel Xeon, up to 5 Gbps, and roughly 60x on Intel Core Ultra 9, up to 6 Gbps. The solution pairs Atsign's trusted identity management, namespace isolation, scoped data sharing, end-to-end encryption and auditability with Intel's hardware-backed key generation, accelerated encryption and hashing, protected key storage, secure boot, Trusted Compute, Total Memory Encryption and Full Disk Encryption. Atsign CEO Aparna Rayasam called the result a performance breakthrough and a game-changing evolution for systems where AI-enabled devices must operate autonomously at the edge. Intel has also added Atsign to its Industrial Builders partner program, giving Intel customers access to Atsign's pre-validated solutions, streamlined sourcing, compliance assurance and direct collaboration on RFPs, reference architectures and proof-of-concept deployments.

The Bank of Thailand, together with financial business operators under its supervision and 11 associations, announced a declaration of intent and a proactive cooperation framework to prevent illicit transactions in the financial sector, known as the Framework for Safeguarding the Financial Sector from Illicit Activities, at a press conference titled "One Intent, United Strength, Protecting Thailand's Financial Sector" on September 10, 2026. Mr. Vitai Ratanakorn, Governor of the Bank of Thailand, said the signing was not merely an MOU or a symbolic gesture, but an agreement with a clear commitment that all parties must genuinely act to raise supervisory standards. The 11 bodies that jointly drafted the cooperation framework are the Thai Bankers' Association, the Association of International Banks, the Government Financial Institutions Association, the Thai E-Payment Association, the Thai Foreign Exchange and Financial Services Association, as well as six associations and clubs of non-bank lenders. They will jointly raise the level of KYC, CDD and EDD, scrutinize high-risk cash transactions, deploy advanced technology to proactively detect abnormal transactions, develop a database of high-risk individuals and connect it to the Central Fraud Registry, produce industry AML/CFT manuals, and use community networks to build financial immunity for vulnerable groups. Mr. Vitai also disclosed that past measures have begun to show concrete results. Requiring that cash withdrawals exceeding 5 million baht undergo screening and verification reduced cash withdrawals in the portion above 5 million baht from about 100 billion baht a month to about 4 billion baht. Meanwhile, supervision of withdrawals and online gold trading above 50 million baht, or gold bars above 2 kilograms, cut such gold withdrawals by about 70 percent. He expects that in October 2026, a measure will take effect requiring those depositing 5 million baht or more in cash to explain the source of funds and provide evidence. At the same time, the Securities and Exchange Commission is in the process of holding a public hearing on regulatory criteria for USDT, with an announcement expected in the next few months. For the next phase, the Bank of Thailand is preparing to upgrade cooperation among five key agencies, namely the Bank of Thailand, the Securities and Exchange Commission, the Anti-Money Laundering Office, the National Anti-Corruption Commission, and the Royal Thai Police, in order to exchange information systematically and across the whole country.

The Bank of Thailand and 11 supervised business associations are jointly driving a cooperative framework to prevent illicit transactions in the financial sector, known as the Framework for Safeguarding the Financial Sector from Illicit Activities, aimed at proactively preventing the financial sector from becoming a channel that supports illegal activity. Mr. Vitai Ratanakorn, Governor of the Bank of Thailand, said the key principle is for all agencies to set direction, policy, and corporate governance to prevent misuse of the financial system, with minimum standards appropriate to each business and continuous improvement of measures as circumstances change. Participating agencies will bring their expertise in data, technology, and capabilities to monitor, detect, and respond to risks, and will exchange information, knowledge, patterns of wrongdoing, warning signals, and best practices among themselves. The businesses that have established this cooperative framework comprise 11 bodies: the Thai Bankers' Association, the Association of International Banks, the Government Financial Institutions Association, the Thai E-Payment Association, the Thai Foreign Exchange and Financial Services Association, as well as six associations and clubs of non-commercial bank business groups. Together they will raise the standard of KYC, CDD, and EDD; scrutinise high-risk cash transactions; deploy advanced technology to proactively detect abnormal transactions; develop a database of high-risk individuals; connect with the Central Fraud Registry; produce industry AML/CFT manuals; and use community networks to build financial immunity for vulnerable groups.

The National Police Agency on the 10th released its assessment of the cyber threat landscape, revealing that 123 cases of ransomware, malware that encrypts data for ransom, were confirmed in the first half of this year from January to June, the highest for any half-year period since statistics began being kept in 2020. Reports of damage rose by 7 cases compared with the same period last year, with 31 of them involving large companies. More than half of all victims took a month or longer to recover, nine companies saw all operations halted, and in 60 percent of cases the damage exceeded 10 million yen. Suspicious accesses detected by the agency surged to about 13,700 per day in the first half, 1.5 times the level of a year earlier, and the agency said the sources of ransomware and other attacks may be probing devices for vulnerabilities. Losses from internet fraud rose 45 percent year on year to 175.5 billion yen, the worst pace on record, while reports of phishing, in which fake emails lure users into giving up passwords and other information, totaled about 730,000, with analysis estimating that 45 percent of the servers sending them were located in China, followed by Japan at 14 percent and Brazil at 10 percent.

SailPoint reported fiscal Q2 2027 ARR of $1.231 billion, up 25% year-over-year, and raised its full-year ARR guidance to $1.38 billion while reiterating long-term targets of at least $2.1 billion ARR and at least $800 million in AI-driven ARR by fiscal 2029. The company's AI-driven ARR has already crossed $70 million, and SaaS ARR grew 36% to $847 million, representing 97% of net new ARR. Management highlighted the launch of SailPoint Identity Security with generally available Agentic Fabric, the acquisition of Entro Security, and new connectors for Snowflake, Databricks, and Cursor. CFO Brian Carolan guided Q3 ARR to $1.29 billion, revenue to $328 million, and adjusted EPS of $0.07 to $0.08, while noting that a higher SaaS mix creates a temporary revenue timing headwind of approximately $5 million.

Visa has unveiled its Singapore Security Roadmap 2026 and Beyond, a comprehensive strategy to strengthen the resilience of Singapore's digital payments ecosystem against evolving fraud, scams, and cyber threats. The roadmap outlines six strategic priorities, including strengthening cybersecurity, advancing authentication, enabling safer transactions through tokenisation, transforming eCommerce checkout experiences, leveraging foundational standards and risk programs, and building a resilient payments ecosystem to combat fraud and scams in the AI era. Visa's study shows that close to seven in 10 Singapore residents trust digital payments, but 42 per cent have encountered scams, with only 8 per cent losing money. To address these threats, Visa is investing in AI-powered fraud detection, tokenisation, and authentication innovations like passkeys and biometrics, deploying over 150 AI and machine learning models globally. The roadmap emphasizes ecosystem-wide collaboration with regulators, financial institutions, merchants, and fintechs to enhance cyber resilience and intelligence sharing.