Author: Matthew Miller

Brief Overview

• AI agents are increasingly being adopted in organizations, frequently lacking appropriate governance.
• These agents manage sensitive information and demand rigorous access controls.
• Machine identities surpass human identities, complicating security management.
• Organizations face security risks from AI agents with excessive permissions.
• New standards such as MCP heighten the number of connections requiring secure oversight.
• Contemporary identity security must progress to encompass AI agents.
• Palo Alto Networks’ Idira aids in managing access across various identity types.

The Growth of AI Agents in Organizations

AI agents are swiftly becoming a fundamental part of the enterprise identity framework. However, numerous organizations are implementing them more quickly than they can regulate, leading to significant blind spots regarding the access capabilities of these agents, the systems they can connect to, and how that access is managed.

As AI agents increasingly engage with sensitive information and automate operational workflows on behalf of users, they are being integrated into customer service, software development, and knowledge management. The primary security concern is not just what these agents are capable of, but whether organizations truly grasp and govern the privileges they have been assigned.

A New Category of Privileged Identity

Many organizations still wrongly interpret AI agents as simple software applications. In reality, they function as digital workers, capable of retrieving data, initiating workflows, and interfacing with critical business applications. Whether linked to internal knowledge repositories or customer-centric platforms, these agents frequently handle extremely sensitive data. Nevertheless, distinct ownership and visibility of how these permissions are utilized remain significantly inadequate.

This issue arises at a moment when the overall identity landscape already faces considerable pressure. Palo Alto Networks’ 2026 Identity Security Landscape Report revealed that machine identities now exceed human identities by a ratio of 109 to 1 in Australia, with both machine and AI agent identities anticipated to surge in the upcoming year. As organizations expand their AI initiatives, they are adding a vast, intricate layer of non-human users that necessitate the same visibility, governance, and accountability that have traditionally been applied to human employees.

The Broadening Attack Surface

AI agents are not intrinsically risky; the danger arises when organizations assign enterprise-level privileges before implementing enterprise-level controls. Our research shows that Australian organizations estimate around 40% of AI agents and 41% of machine identities already have access to organizational data, including vital business systems.

An AI agent with excessive permissions presents an attractive target for cybercriminals. If breached, manipulated, or misused, it turns into a trusted entryway into the organization, enabling malicious actors to navigate laterally through networks, remove data, or interrupt essential operations.

This issue is compounded by emerging standards like the Model Context Protocol (MCP). While MCP is beneficial for scaling agentic AI by establishing a consistent method for agents to communicate with databases and enterprise applications, it concurrently amplifies the number of credentials, permissions, and trust relations that are active throughout the network.

Each new link between an AI agent and a business system generates an access route that must be protected. As organizations develop these interconnected AI ecosystems, insight into who or what possesses access to critical systems becomes as critical as securing the AI models themselves.

Advancing Governance for the Agentic Age

To reduce these risks, contemporary identity security principles must be broadened to encompass all identity types, including human, machine, and agentic.

This necessitates a thorough strategy: identifying and cataloging all AI identities, implementing lifecycle management, enforcing stringent least-privilege access, and consistently monitoring for unusual activity. It additionally involves ensuring human oversight for compliance and guaranteeing that access can be immediately revoked if an agent is compromised or decommissioned.

As AI agents become deeply integrated into everyday operations, traditional identity tools will become insufficient. Organizations need advanced identity security platforms that extend governance beyond typical human users. The industry is experiencing a profound transformation: transitioning from managing only human access to governing every single identity operating within the enterprise from a centralized control framework.

To assist organizations in navigating this transition, Palo Alto Networks has recently introduced Idira. By merging privileged access management with capabilities for machine and agentic identity security, Idira offers a unified platform to discover, secure, and govern access across all identity types.

AI agents are swiftly becoming the most interconnected and privileged entities within the enterprise. As Australian organizations continue to expand agentic AI, strong governance will shift from being an obstacle to becoming the ultimate facilitator of security, trust, and innovation.

Conclusion

As AI agents become increasingly integrated into enterprise practices, they introduce new challenges for identity management and security. Organizations must tackle the governance of these agents to avert security incidents and maintain compliance. The emergence of AI agents requires a transformation in identity security strategies, with platforms like Palo Alto Networks’ Idira offering the essential tools for managing an array of identity types.

Q: What are AI agents and how are they utilized in organizations?

A: AI agents are software applications that carry out automated functions and interact with data and systems. In organizations, they are employed for customer service, software development, and knowledge management, among various other activities.

Q: Why do AI agents present a security concern?

A: AI agents create a security concern when they are given excessive privileges without adequate controls, rendering them potential targets for attackers aiming to exploit their access to confidential data and systems.

Q: What is the Model Context Protocol (MCP) and what impact does it have on AI agents?

A: The MCP is a protocol that streamlines interactions between AI agents and enterprise applications. While it aids in the scalability of AI deployment, it also complicates the management of credentials and access routes.

Q: How can organizations enhance governance for AI agents?

A: Organizations can strengthen governance by cataloging AI identities, managing their lifecycles, enforcing least-privilege access, and scrutinizing for anomalies, ensuring human oversight and quick response to security incidents.

Q: What is Palo Alto Networks’ Idira, and how does it assist with AI agent governance?

A: Idira is a solution from Palo Alto Networks that merges privileged access management with machine and agentic identity security features, providing a cohesive approach for discovering, securing, and managing access for all identity types.

Quick Overview

• Kanchana Devi has been appointed as the leader of group cyber security at JB Hi-Fi Group.
• Devi has a robust background with the University of Melbourne and Accenture.
• Devi’s goal is to improve cyber resilience and foster secure innovation.
• JB Hi-Fi Group comprises JB Hi-Fi, The Good Guys, and e&s.
• Former cyber security head Daniel Eastley is now the CISO at the Country Fire Authority in Victoria.

Overview

In a calculated initiative to strengthen its cybersecurity framework, JB Hi-Fi Group has revealed the appointment of Kanchana Devi as the leader of group cyber security. This follows the exit of Daniel Eastley in April, who has transitioned to a key position at the Country Fire Authority in Victoria.

Kanchana Devi’s Path

Kanchana Devi shared her excitement about joining JB Hi-Fi Group in her latest LinkedIn update. She is keen to partner with diverse teams within the group to boost cyber resilience and secure business functions, while also promoting safe innovation in the contemporary digital landscape.

Devi’s considerable experience encompasses her recent position at the University of Melbourne and a noteworthy 13-year tenure at Accenture, where she refined her skills in cyber security and digital transformation.

Retail Footprint of JB Hi-Fi Group

JB Hi-Fi Group is a prominent name in the retail domain, featuring well-known brands like JB Hi-Fi, The Good Guys, and e&s. The group’s dedication to enhancing its cybersecurity measures is underscored by Devi’s appointment, with the aim of safeguarding their extensive customer base and business operations.

New Position for Daniel Eastley

Daniel Eastley, who previously occupied a leadership role at JB Hi-Fi Group, now assumes the role of Chief Information Security Officer (CISO) at the Country Fire Authority in Victoria. His time at the Australian Red Cross Lifeblood equipped him with invaluable insights into infrastructure and security, which he now applies in the fire authority.

Conclusion

Kanchana Devi’s appointment as head of group cyber security at JB Hi-Fi Group signifies an important advancement in reinforcing the company’s cyber resilience. Her extensive background from earlier roles and her vision for secure innovation are in line with the group’s goals of protecting its operations and customer information.

Q: Who is the newly appointed head of group cyber security at JB Hi-Fi Group?

A: Kanchana Devi has taken on the role of the new head of group cyber security.

Q: What expertise does Kanchana Devi bring to JB Hi-Fi Group?

A: Devi brings extensive expertise stemming from her positions at the University of Melbourne and Accenture.

Q: Which brands are part of the JB Hi-Fi Group?

A: The JB Hi-Fi Group consists of JB Hi-Fi, The Good Guys, and e&s.

Q: What is Daniel Eastley’s new position following his departure from JB Hi-Fi Group?

A: Daniel Eastley is now the Chief Information Security Officer at the Country Fire Authority in Victoria.

Brief Overview

• Alinta Energy has introduced AISE, a system using AI for executive insights.
• AISE links executives to data and documents, improving decision processes.
• The system was created in partnership with Databricks.
• AISE analyzes 500 data metrics and more than 9000 documents.
• Each insight features a confidence score for better guidance.
• AISE is fully implemented and growing within Alinta Energy.

Brief Overview

• Data breach at Partnered Health impacts 21 clinics.
• Confidential personal and medical information has been compromised.
• Legal restraining order secured to avoid data exploitation.
• Possible scam risks targeting those impacted.
• Bupa intends to purchase Partnered Health for $450 million.

Details of the Breach

On June 23, Partnered Health, based in Adelaide, disclosed a major data breach involving 21 of its general practitioner clinics. The incident led to the unauthorized access of sensitive personal and medical details, including names, addresses, contact numbers, Medicare, private health insurance, and Veteran Card identifiers.

Medical data and treatment records were allegedly accessed during the breach. Nevertheless, Partnered Health has not provided technical details about the attack or the complete scope of the compromised data.

Legal Actions and Security Protocols

Following the breach, Partnered Health secured a court injunction from the Supreme Court of New South Wales to block the use or release of the stolen data. The organization has also cautioned its customers to remain alert to potential scams arising from the inappropriate use of their personal information.

Corporate News

In light of the data breach, health insurance and medical service operator Bupa has announced plans to acquire Partnered Health for $450 million. This acquisition is awaiting approval from the Australian Competition and Consumer Commission and the Foreign Investment Review Board.

Conclusion

Partnered Health has faced a significant data breach impacting 21 clinics, with personal and medical information being compromised. Legal measures are underway to deter the misuse of data, while Bupa is set to make a substantial acquisition of the organization.

Questions & Answers

Q: What type of information was compromised in the breach?

A: The breach involved names, addresses, contact numbers, Medicare, private health insurance, Veteran Card identifiers, and medical data.

Q: How many clinics were impacted by the data breach?

A: The breach affected a total of 21 clinics.

Q: What legal actions has Partnered Health implemented?

A: Partnered Health has secured an injunction from the Supreme Court of New South Wales to prevent the misuse of the stolen information.

Q: What should individuals affected be mindful of?

A: Affected individuals should be wary of scams that might leverage their compromised data.

Q: Who is in the process of acquiring Partnered Health?

A: Bupa is in the process of acquiring Partnered Health for $450 million, pending regulatory approvals.

Overview

• Colonial First State designates Sid Baidwan as the Group Executive of Data and AI.
• Baidwan formerly worked as Chief AI Officer at Smartgroup and directed AI transitions at Suncorp.
• His responsibilities will center on advancing AI and data strategy for the benefit of members, advisers, and employees.
• Australia’s superannuation framework is on track to become the second-largest globally.
• Baidwan intends to utilize AI to enhance wealth accumulation and retirement transitions.

Sid Baidwan’s Role

Image credit: LinkedIn.

Colonial First State has named Sid Baidwan as its Group Executive of Data and AI. Baidwan joined the company in June, bringing in experience from his prior position as Chief AI Officer at Smartgroup and having undertaken AI transformation at Suncorp.

Leading AI Initiatives at CFS

Baidwan’s appointment was initially alluded to in a LinkedIn update in May and has now been officially confirmed. A representative from Colonial First State (CFS) mentioned that Baidwan is anticipated to lead the organization’s AI and data strategy, aiming to convert AI capabilities into real value for members, advisers, and employees.

With extensive knowledge in both technical engineering and commercial strategy, Baidwan’s position is viewed as critical to enhancing the organization’s technological prowess. His leadership is expected to foster innovation within Australia’s expanding superannuation industry.

Overview of Australia’s Superannuation

In a LinkedIn message, Baidwan conveyed his enthusiasm for spearheading AI and data projects at CFS. He underscored the forthcoming expansion of Australia’s superannuation system, which is expected to grow into the second-largest retirement savings reservoir worldwide. This expansion, along with an ageing demographic, offers both challenges and prospects that Baidwan aims to tackle through AI-focused innovations.

Data and AI are anticipated to play an essential part in transforming the superannuation structure, facilitating enhanced services for advisers and clients, and promoting wealth growth along with secure retirement transitions.

Conclusion

With Sid Baidwan at the forefront, Colonial First State stands ready to harness AI and data strategies to improve its services and respond to the increasing demands of Australia’s superannuation landscape. His guidance signifies a major advance towards innovative solutions that aim to better meet the needs of advisers and clients while ensuring a smooth transition to retirement.

Q&A

Q: What role has Sid Baidwan been appointed to at Colonial First State?

A: Sid Baidwan has been appointed as the Group Executive of Data and AI at Colonial First State.

Q: What prior positions did Baidwan hold?

A: Baidwan was the Chief AI Officer at Smartgroup and also oversaw AI changes at Suncorp.

Q: What will be Baidwan’s primary objective in his new position?

A: His primary objective will be to enhance Colonial First State’s AI and data strategy to generate value for members, advisers, and employees.

Q: Why is the data and AI role important for CFS?

A: Data and AI are vital for advancing the superannuation system and improving service, wealth growth, and retirement security.

Q: How is Australia’s superannuation system expected to evolve?

A: It is anticipated to become the globe’s second-largest retirement savings pool, offering avenues for innovation.

Q: What opportunities does Baidwan perceive in the superannuation field?

A: Baidwan sees opportunities for innovation through AI to enhance support for advisers and clients and to facilitate wealth growth and secure retirement transitions.

Quick Overview

• Telstra is experiencing a nationwide mobile service disruption due to unlogged configuration alterations and obsolete firmware.
• An undocumented modification raised a server’s time authority status, resulting in interruptions.
• The outdated GPS card reset the network’s clock to 2006, causing errors in customer devices.
• Telstra has received 8,000 requests for compensation, with $100,000 already disbursed.
• Telstra has partnered with Technology Audit Partners for a comprehensive investigation.

Understanding the Outage

The recent mobile network outage at Telstra is linked to a combination of an unlogged configuration modification and an overlooked firmware update on its Symmetricom SSU-2000 Network Time Synchronisation System. This detail emerged during a senate inquiry, revealing additional complexity to the initial assessment of the problem.

Telstra initially identified a node tasked with timekeeping in its mobile network as the source of the disruption. Accurate timekeeping is vital for mobile networks, structured into various layers or “stratums.” Telstra utilizes the Network Time Protocol (NTP), relying on atomic clocks at Stratum 0 as the primary time source.

Clarifying the Timekeeping Issue

In Telstra’s standard network configuration, the SSU-2000 occupies Stratum 3 in the time hierarchy. However, a failure to connect with Stratum 2 servers led to an undocumented rise to Stratum 1. This adjustment permitted the unit to rely on its onboard GPS card for timekeeping, which had not been updated due to its prior inactivity.

Public records indicate that the SSU-2000 is roughly 24 years old, with GPS cards using a legacy time counter that resets every 1024 weeks. This caused the internal clock to revert to November 2006, resulting in devices showing incorrect dates and potentially interfering with secure communications.

Compensation and Inquiry

Michael Ackland, Telstra’s CFO, mentioned that the company has handled about 8,000 compensation requests, with $100,000 already compensated. Bigger claims are still being evaluated. CEO Vicki Brady confirmed the engagement of Technology Audit Partners to carry out a thorough examination of the incident.

Conclusion

The Telstra network disruption highlights the crucial need for maintaining up-to-date system configurations and documentation. As Telstra manages customer compensations and ongoing investigations, this event serves as a reminder of the complex interdependencies in telecommunications networks.

Common Questions

Q: What led to the Telstra network disruption?

A: The disruption resulted from an unlogged configuration change coupled with an outdated firmware update on a timekeeping unit.

Q: In what way did the timekeeping problem impact customers?

A: Customers faced incorrect device times, which could have disrupted secure communications and network access.

Q: What actions is Telstra taking to resolve the issue?

A: Telstra has brought in Technology Audit Partners for a comprehensive investigation and is processing compensation claims from those affected.

Q: How much compensation has Telstra disbursed to date?

A: Telstra has issued around $100,000 in compensation, with larger claims still under consideration.

Q: What function does the SSU-2000 serve in Telstra’s network?

A: The SSU-2000 is integral to Telstra’s timekeeping framework, typically situated at Stratum 3 in the network time structure.

Q: Why was the GPS card not updated?

A: The GPS card was not updated because it was not in active use; its significance grew after the server’s undocumented rise to Stratum 1.