Visa has rolled out a new system that allows artificial intelligence (AI) to not only suggest items to buy but also complete purchases for users. The newly launched platform, called Visa Intelligent Commerce, lets AI assistants shop on your behalf — while keeping your financial data secure.
The announcement was made recently during Visa’s event in San Francisco. This marks a step towards AI taking on more day-to-day tasks for users, including buying products, booking services, and managing online orders — all based on your instructions.
AI That Does More Than Just Help You Shop
Today, many AI tools can help people find products or services online. But when it comes to actually completing the purchase, those systems often stop short. Visa is working to close that gap by allowing these tools to also handle payments.
To do this, Visa has teamed up with top tech companies like Microsoft, IBM, OpenAI, Samsung, and others. Their combined goal is to build a secure way for AI to handle payments without needing access to your actual card details.
How the Technology Works
Instead of using your real credit or debit card numbers, the platform turns your card information into a digital token — a safe, coded version of your payment data. These tokens are used by approved AI agents when carrying out transactions.
Users still stay in control. You can set limits on how much the AI can spend, pick which types of stores it’s allowed to use, or even require a manual approval before it pays.
For example, you might ask your AI to book a hotel room under a certain price or order groceries every week. The AI would then search websites, compare options, and make the purchase — all without you needing to fill out your payment details each time.
Safety Is the Main Priority
Visa is aware that letting AI spend money on your behalf might raise concerns. That’s why they’ve built strong protections into the system. Only AI agents that you’ve approved can access your tokenized payment info. Every transaction is monitored in real time by Visa’s fraud-detection systems — which have already helped prevent billions in fraud before.
The company is also using data tools that protect your privacy. When the AI needs data to personalize your shopping, it uses temporary access methods that keep you in charge of what’s shared.
Visa believes this could be the next big change in online shopping, similar to past shifts from physical stores to websites, and then from computers to phones. With their global network already in place, Visa is prepared to support this new way of shopping across many countries.
Developers can start using the tools now, and test programs will roll out soon. As AI becomes part of daily life, Visa hopes this new system will make everyday shopping faster, easier, and more secure.
A new report from IBM’s X-Force 2025 Threat Intelligence Index shows that cybercriminals are changing their tactics. Instead of mainly using ransomware to lock systems, more hackers are now trying to quietly steal login information. IBM studied over 150 billion security events each day from 130+ countries and found that infostealers, a type of malware sent through emails to steal data, rose by 84% in 2024 compared to 2023.
This change means that instead of damaging systems right away, attackers are sneaking into networks to steal passwords and other sensitive information. Mark Hughes, a cybersecurity leader at IBM, said attackers are finding ways into complex cloud systems without making a mess. He also advised businesses to stop relying on basic protection methods. Instead, companies should improve how they manage passwords, fix weaknesses in multi-factor authentication, and actively search for hidden threats before any damage happens.
Critical industries such as energy, healthcare, and transportation were the main targets in the past year. About 70% of the incidents IBM helped handle involved critical infrastructure. In around 25% of these cases, attackers got in by taking advantage of known flaws in systems that had not been fixed. Many hackers now prefer stealing important data instead of locking it with ransomware. Data theft was the method in 18% of cases, while encryption-based attacks made up only 11%.
The study also found that Asia and North America were attacked the most, together making up nearly 60% of global incidents. Asia alone saw 34% of the attacks, and North America had 24%. Manufacturing businesses remained the top industry targeted for the fourth year in a row because even short outages can seriously hurt their operations.
Emerging threats related to artificial intelligence (AI) were also discussed. No major attacks on AI systems happened in 2024, but experts found some early signs of possible risks. For example, a serious security gap was found in a software framework used to create AI agents. As AI technology spreads, hackers are likely to build new tools to attack these systems, making it very important to secure AI pipelines early.
Another major concern is the slow pace of fixing vulnerabilities in many companies. IBM found that many Red Hat Enterprise Linux users had not updated their systems properly, leaving them open to attacks. Also, ransomware groups like Akira, Lockbit, Clop, and RansomHub have evolved to target both Windows and Linux systems.
Lastly, phishing attacks that deliver infostealers increased by 180% in 2024 compared to the year before. Even though ransomware still accounted for 28% of malware cases, the overall number of ransomware incidents fell. Cybercriminals are clearly moving towards quieter methods that focus on stealing identities rather than locking down systems.
In a defining move for digital security, the National Institute of Standards and Technology (NIST) has given its official approval to three quantum-resistant algorithms developed in collaboration with IBM Research. These algorithms are designed to safeguard critical data and systems from the emerging threats posed by quantum computing.
The Quantum Computing Challenge
Quantum computing is rapidly approaching, bringing with it the potential to undermine current encryption techniques. These advanced computers could eventually decode the encryption protocols that secure today’s digital communications, financial transactions, and sensitive information, making them vulnerable to breaches. To mitigate this impending risk, cybersecurity experts are striving to develop encryption methods capable of withstanding quantum computational power.
IBM's Leadership in Cybersecurity
IBM has been at the forefront of efforts to prepare the digital world for the challenges posed by quantum computing. The company highlights the necessity of "crypto-agility," the capability to modify cryptographic methods to prepare in the face of rapid development of security challenges. This flexibility is especially crucial as quantum computing technology continues to develop, posing new threats to traditional security measures.
NIST’s Endorsement of Quantum-Safe Algorithms
NIST's recent endorsement of three IBM-developed algorithms is a crucial milestone in the advancement of quantum-resistant cryptography. The algorithms, known as ML-KEM for encryption and ML-DSA and SLH-DSA for digital signatures, are integral to IBM's broader strategy to ensure the resilience of cryptographic systems in the quantum era.
To facilitate the transition to quantum-resistant cryptography, IBM has introduced two essential tools: the IBM Quantum Safe Explorer and the IBM Quantum Safe Remediator. The Quantum Safe Explorer helps organisations identify which cryptographic methods are most susceptible to quantum threats, guiding their prioritisation of updates. The Quantum Safe Remediator, on the other hand, provides solutions to help organisations upgrade their systems with quantum-resistant cryptography, ensuring continued security during this transition.
As quantum computing technology advances, the urgency for developing encryption methods that can withstand these powerful machines becomes increasingly clear. IBM's contributions to the creation and implementation of quantum-safe algorithms are a vital part of the global effort to protect digital infrastructure from future threats. With NIST's approval, these algorithms represent a meaningful leap forward in securing sensitive data and systems against quantum-enabled attacks. By promoting crypto-agility and offering tools to support a smooth transition to quantum-safe cryptography, IBM is playing a key role in building a more secure digital future.
In an unexpected move that has disrupted the cybersecurity equilibrium, IBM has announced its exit from the cybersecurity software market by selling its QRadar SaaS portfolio to Palo Alto Networks. This development has left many Chief Information Security Officers (CISOs) rethinking their procurement strategies and vendor relationships as they work to rebuild their Security Operations Centers (SOCs).
IBM's QRadar Suite: A Brief Overview
The QRadar Suite, rolled out by IBM in 2023, included a comprehensive set of cloud-native security tools such as endpoint detection and response (EDR), extended detection and response (XDR), managed detection and response (MDR), and key components for log management, including security information and event management (SIEM) and security orchestration, automation, and response (SOAR) platforms. The suite was recently expanded to include on-premises versions based on Red Hat OpenShift, with plans for integrating AI capabilities through IBM's Watsonx AI platform.
The agreement, expected to close by the end of September, also designates IBM Consulting as a "preferred managed security services provider (MSSP)" for Palo Alto Networks customers. This partnership will see the two companies sharing a joint SOC, potentially benefiting customers looking for integrated security solutions.
Palo Alto Networks has assured that feature updates and critical fixes will continue for on-premises QRadar installations. However, the long-term support for these on-premises solutions remains uncertain.
Customer Impact and Reactions
The sudden divestiture has taken the cybersecurity community by surprise, particularly given IBM's significant investment in transforming QRadar into a cloud-native platform. Eric Parizo, managing principal analyst at Omdia, noted the unexpected nature of this move, highlighting the substantial resources IBM had dedicated to QRadar's development.
Customers now face a critical decision: migrate to Palo Alto's Cortex XSIAM platform or explore other alternatives. Omdia's research indicates that IBM's QRadar was the third-largest next-generation SIEM provider, trailing only Microsoft and Splunk (now part of Cisco). The sudden shift has left many customers seeking clarity and solutions.
Market Dynamics
This acquisition comes at a pivotal time in the cybersecurity industry, with SIEM, SOAR, and XDR technologies increasingly converging into unified SOC platforms. Major players like AWS, Microsoft, Google, CrowdStrike, Cisco, and Palo Alto Networks are leading this trend. Just before IBM's announcement, Exabeam and LogRhythm revealed their merger plans, aiming to combine their SIEM and user and entity behaviour analytics (UEBA) capabilities.
Forrester principal analyst Allie Mellen pointed out that IBM's QRadar lacked a fully-fledged XDR offering, focusing more on EDR. This gap might have influenced IBM's decision to divest QRadar.
For Palo Alto Networks, acquiring QRadar represents a significant boost. The company plans to integrate QRadar's capabilities with its Cortex XSIAM platform, known for its automation and MDR features. While Palo Alto Networks has made rapid advancements with Cortex XSIAM, analysts like Parizo believe it still lacks the maturity and robustness of IBM's QRadar.
Palo Alto Networks intends to offer free migration paths to its Cortex XSIAM for existing QRadar SaaS customers, with IBM providing over 1,000 security consultants to assist with the transition. This free migration option will also extend to "qualified" on-premises QRadar customers.
The long-term prospects for QRadar SaaS under Palo Alto Networks remain unclear. Analysts suggest that the acquisition aims to capture QRadar's customer base rather than sustain the product. As contractual obligations expire, customers will likely need to transition to Cortex XSIAM or consider alternative vendors.
A notable aspect of the agreement is the incorporation of IBM's Watsonx AI into Cortex XSIAM, which will enhance its Precision AI tools. Gartner's Avivah Litan highlighted IBM's strong AI capabilities, suggesting that this partnership could benefit both companies.
In conclusion, IBM's exit from the cybersecurity software market marks a paradigm shift, prompting customers to reevaluate their security strategies. As Palo Alto Networks integrates QRadar into its offerings, the industry will closely watch how this transition unfolds and its impact.
Businesses need to have a solid security plan in place to handle their SaaS security concerns if they want to fully benefit from cloud computing. In the first place, what are these worries?
Cyberattacks will cost businesses $10.5 trillion annually by 2025, a 300% increase over 2015, predicts McKinsey. Businesses need to keep up with the latest developments in data security if they want to reduce the risk and expense of cyberattacks. They must adopt a shared responsibility model and cloud-native solutions built with DevSecOps standards to actively manage their SaaS security.
IBM's widely used Aspera Faspex file transfer system has a serious problem. A critical bug that could allow hackers to run any code they want is being used by cybercriminals, including ransomware groups. Even though IBM has released a patch to fix the issue, many organizations have failed to install it.
Researchers are warning that this vulnerability is being exploited, and one of their customers was recently hacked due to this problem. It's important to take immediate action to fix this vulnerability to avoid being targeted by hackers.
Aspera Faspex is a software application that provides secure file transfer capabilities to businesses and organizations. It is widely used across various industries, including media and entertainment, healthcare, finance, and government agencies.
The vulnerability (CVE-2022-5859) in Aspera Faspex version 4.1.3 and earlier versions arises from insufficient validation of user-supplied input in the software. Attackers could exploit this vulnerability by sending specially crafted data to the application, leading to arbitrary code execution. This could enable attackers to bypass authentication and execute code on the vulnerable system, which could result in significant data breaches and other security incidents.
The vulnerability in Aspera Faspex is considered critical, with a CVSS rating of 9.8 out of 10. This means that it is highly exploitable and could have severe consequences for organizations using the software. Attackers could gain unauthorized access to sensitive data, execute malicious code, and cause significant disruptions to business operations.
IBM has recommended that organizations using the affected version of the software should upgrade to a patched version as soon as possible to address the vulnerability. Timely patching is critical in mitigating the risk of cyberattacks and data breaches. Organizations that delay patching are putting themselves at increased risk of cyberattacks and other security incidents.
In addition to timely patching, implementing robust security measures is crucial in preventing cyberattacks and minimizing the impact of security incidents. IBM has emphasized the importance of following standard security practices, including network segmentation and monitoring for unusual behavior. These security measures can help organizations detect and respond to security incidents in a timely manner.
The Aspera Faspex vulnerability is a reminder of the importance of prioritizing security in any organization. With the evolving security landscape, organizations must remain vigilant and continuously update their security measures to mitigate the risk of cyberattacks and other security incidents. Failure to take prompt action in addressing vulnerabilities could have severe consequences for organizations, including financial losses, reputational damage, and legal implications.