Category: Australia Tech News

Brief Overview

• The Australian Signals Directorate (ASD) intends to phase out the Essential Eight cybersecurity framework within the next two years.
• A novel “Essentials” series will take its place, encompassing IT, cloud, operational technology, and agentic AI.
• This change is designed to overcome structural constraints and offer more adaptable, outcome-oriented guidance.
• Feedback on the initial chapter for enterprise IT is welcome until July 12, 2026.

Shift from Essential Eight to the Updated Essentials Series

The Australian Signals Directorate (ASD) has revealed its intention to phase out the Essential Eight guidance framework in the next two years. This transition is driven by the changing landscape of cybersecurity threats and the necessity for a more holistic approach that addresses contemporary technological scenarios.

The Rationale for Change

Chris Horlyck, who leads cybersecurity resilience at the Australian Cyber Security Centre (ACSC) within ASD, indicated that the Essential Eight was initially crafted for traditional IT environments and does not adequately extend to cloud-based and shared-responsibility models. As cloud usage has become commonplace, the framework’s deficiencies in these contexts required a move toward more versatile and outcome-focused guidelines.

Presenting the Essentials Series

The upcoming “Essentials” series will fill these voids by concentrating on specific security areas such as enterprise IT, operational technology, cloud, and potentially agentic artificial intelligence (AI). The innovative framework will offer organisations the agility to implement security strategies that correspond with their unique operational demands.

Emphasis on Contemporary Defensible Architecture

The new Essentials series is shaped by ASD’s Modern Defensible Architecture document, highlighting a layered defense method and the safeguarding of crucial assets over a simple perimeter-based strategy. This initiative is intended to help organisations sustain strong cybersecurity frameworks against evolving threats.

Tackling Previous Concerns

The transition to the Essentials series also aims to resolve ongoing issues regarding the maturity level demands of the Essential Eight, which have been regarded as variable. By separating threat-informed controls from a rigid maturity structure, the new framework seeks to offer more consistent and foreseeable guidance.

Next Steps and Stakeholder Engagement

ASD has initiated a consultation process for the Essentials series, beginning with the first chapter that concentrates on enterprise IT. Stakeholders are encouraged to share their perspectives via the ACSC Partner Portal by July 12, 2026, making sure that the new framework meets the diverse requirements of the cybersecurity sector.

Conclusion

The discontinuation of the Essential Eight framework signifies a major evolution in Australia’s cybersecurity strategy, introducing a more adaptive Essentials series. By addressing earlier limitations and emphasizing flexible security results, ASD aims to better prepare organisations to handle the complexities of modern cyber threats.

Q: What led to the shift from the Essential Eight to the Essentials series?

A: The transition was prompted by the necessity of addressing the structural shortcomings of the Essential Eight, specifically its limited applicability to cloud and shared-responsibility contexts.

Q: What areas will the new Essentials series encompass?

A: The Essentials series will focus on distinct security areas such as enterprise IT, operational technology, cloud, and potentially agentic AI.

Q: In what way will the new framework offer enhanced flexibility?

A: The Essentials series will prioritize outcomes and intent over rigid controls, enabling organisations to select tools that best suit their particular environments.

Q: Will existing investments in Essential Eight compliance be disregarded?

A: No, the current investments in Essential Eight compliance will still hold relevance under the new Essentials framework.

Q: What is the timeline for the phase-out of the Essential Eight?

A: The Essential Eight will stay in effect during a transition phase, with deprecation commencing in 12 months and complete cessation within 24 months.

Q: How can organisations give their input on the new Essentials series?

A: Organisations can submit feedback on the initial chapter of the Essentials series through the ACSC Partner Portal by July 12, 2026.

Brief Overview

• Five Eyes intelligence agencies highlight the pressing need to tackle AI-related cyber threats.
• AI boosts the velocity and intricacy of cyber assaults.
• Cyber risk is now an essential business risk, rather than merely a technical matter.
• ‘Secure by design’ and ‘secure by default’ are essential principles for organizations.
• Organizations must gear up for possible breaches with solid response plans.
• Export restrictions on AI models may put cyber defenders at a disadvantage.

AI and the Evolving Cyber Threat Environment

Cyber security agencies from the Five Eyes nations, which include Australia, Canada, New Zealand, the United Kingdom, and the United States, are amplifying efforts to inform about the risks of AI being exploited by malicious entities. With AI’s capacity to lower entry barriers for attackers and speed up cyber threats, the timeframe for responsive measures is alarmingly brief.

AI serves both attackers and defenders, providing tools to bolster defenses while simultaneously complicating attacks. The agencies caution that cyber risk is no longer simply a technical issue but a fundamental business risk requiring executive oversight.

Preventive Actions and Leadership Duty

The Australian Signals Directorate (ASD) has revised its Information Security Manual (ISM), vital for government agencies, to include principles such as ‘secure by design’ and ‘secure by default’. The ‘Five Eyes’ agencies encourage organizations to minimize their attack surfaces, speed up patching, and ensure that legacy systems are protected against threats.

Enhancing identity and access controls is essential, with organizations advised to implement strong authentication and routinely assess permissions. Being ready for potential breaches through tested response strategies and training is crucial, focusing on swift containment and recovery.

Issues with AI Export Regulations

Recent actions by the US government have introduced export regulations on AI models like Anthropic’s Fable 5, necessitating non-Americans to secure a license for access. This has ignited discussions, as some security professionals argue that it might disadvantage defenders while adversaries possessing similar technology continue to progress.

Conclusion

The ‘Five Eyes’ intelligence agencies emphasize the critical nature of addressing AI-driven cyber threats. Organizations must recognize cyber risk as an issue for leadership and implement proactive defense strategies, such as complying with updated security principles and preparing for potential breaches. The ramifications of AI export regulations further complicate matters, potentially obstructing defenders while adversaries advance technologically.

Q&A Section

Q: What are the main factors behind the urgency emphasized by the ‘Five Eyes’ agencies?

A: The agencies note that AI diminishes barriers for attackers, heightens the speed and complexity of attacks, and shortens the interval between discovering vulnerabilities and their exploitation.

Q: How should organizations alter their perspective on cyber risk?

A: Organizations ought to regard cyber risk as a fundamental business risk rather than merely a technical challenge, ensuring leadership is engaged in managing and mitigating these risks.

Q: What specific steps can organizations implement to safeguard against AI-driven cyber threats?

A: Organizations should minimize attack surfaces, expedite patching, reinforce identity and access controls, and be ready for breaches with comprehensive response plans.

Q: What concerns arise regarding AI export regulations?

A: These regulations may hinder defenders by restricting access to advanced AI models, while adversaries with comparable technologies continue to enhance their capacities.

Quick Overview

• Employment fraud is extending beyond the tech industry in Australia.
• Healthcare and civil engineering are becoming key targets.
• Fraudsters employ advanced identity theft strategies, including counterfeit LinkedIn profiles.
• Security professionals recommend close cooperation between HR and security divisions.

Introduction

Australia is confronted with a rising threat from employment fraud perpetrators inserting bogus workers in organizations across multiple sectors, such as healthcare, civil engineering, and customer service.

Beyond Tech

Alex Tilley, global threat research coordinator at Okta, has noted an increasing pattern of employment fraud emerging outside the tech sector. This transition has caught other industries off guard regarding such dangers.

Healthcare and Civil Engineering at Risk

Healthcare has been identified as a major victim, with deceitful individuals taking advantage of lax hiring practices to access sensitive information. Likewise, civil engineering firms are at risk, with technical blueprints being compromised by adversaries via remote contractors.

Fraud Methods and Strategies

Tilley highlighted a variety of identity fraud methods, including the employment of duplicated LinkedIn profiles and financially unstable individuals conducting interviews. The creation of synthetic identities associated with North Korean links is also a worrisome trend.

AI Tools and Teamwork

Fraudsters are utilizing AI tools to evade deepfake detection, presenting a challenge for HR and security teams. Tilley advocates for teamwork between these departments to spot fraud signs and safeguard against employment scams.

Conclusion

Employment fraud is proliferating in Australia, affecting sectors beyond technology. Organizations must evolve and implement stringent hiring and security protocols to counter these advanced threats.

Q&A

Q: Which sectors are increasingly vulnerable to employment fraud in Australia?

A: The healthcare, civil engineering, and customer service sectors are seeing heightened targeting.

Q: What techniques do fraudsters commonly use?

A: Methods include utilizing fake LinkedIn profiles, synthetic identities, and AI tools to navigate screening processes.

Q: How can organizations protect against employment fraud?

A: Organizations should strengthen hiring practices, ensure collaboration between HR and security divisions, and remain alert for fraud signs.

Q: Is technology the sole sector impacted by this threat?

A: No, the threat has broadened beyond technology to encompass sectors such as healthcare and civil engineering.

Quick Overview

• Westpac has improved its use of event-driven automation and AIOps within its IT systems.
• Automation is positioned strategically between observability and incident management solutions.
• Integration with ServiceNow boosts the management of CPU and memory alerts.
• AI technologies offer supplementary analysis and insights.
• Caution is recommended in leveraging AI for infrastructure automation.

Westpac’s Tactical Move Towards Automation and AIOps

Westpac is making remarkable progress in incorporating event-driven automation and AIOps into its IT systems, specifically to optimize the management of CPU and memory alerts. This effort builds on the established framework facilitated by the adoption of the Ansible Automation Platform (AAP).

Embedding Automation into Incident Management

The bank has effectively integrated automation within its observability tools and ServiceNow, a prominent IT service management system. This integration supports immediate responses to alerts, significantly shortening the previously required resolution time for such issues.

Streamlined Workflows Through AI Integration

Westpac employs AI models on its OpenShift AI platform to enhance the automation workflow. When a CPU or memory alert occurs, a thorough health assessment is performed, with the collected data analyzed by AI to yield actionable insights, which are then linked to ServiceNow tickets for additional processing.

Insight-Driven Data for Future Automation

The artifacts produced during the alert management process are not only immediate tools but are also utilized for retrospective analysis. This ongoing data collection enables Westpac to pinpoint recurring problems and identify potential automation opportunities, fostering continuous improvement in their IT operations.

Prudent Use of AI in IT Infrastructure

While AI is integral to Westpac’s automation strategy, the bank approaches its use with prudence. Sean Dudding, service owner of patterns automation, highlights the importance of understanding the distinct characteristics of each AI model to guarantee dependable results and avoid possible risks.

Assessing the Possibilities of Coding Assistants

Westpac is also considering the utilization of Lightspeed, a coding assistant within Ansible, to facilitate automation development. Nevertheless, the bank asserts that while these tools can boost developer productivity, they cannot replace the need for skilled coding proficiency.

Conclusion

Westpac’s adoption of automation and AIOps within its IT systems signifies a substantial advancement in operational efficiency. By integrating automation into their incident management protocols and utilizing AI insights, the bank has succeeded in improving its response to crucial alerts. Nonetheless, Westpac remains cautious and deliberate in its AI applications, stressing the necessity of comprehending the limitations and potential of the technology.

Q: What is the main objective of Westpac’s deployment of automation and AIOps?

A: The primary objective is to enhance the efficiency and responsiveness in managing CPU and memory alerts within their IT systems.

Q: How does Westpac incorporate automation into its IT operations?

A: Automation is situated between observability solutions and ServiceNow, facilitating immediate action on alerts and improving incident management.

Q: What function does AI serve in Westpac’s automation strategy?

A: AI models furnish additional analysis and insights on gathered data, enriching the automation process and assisting in decision-making.

Q: How does Westpac utilize the artifacts generated during alerts?

A: These artifacts deliver point-in-time data that is subsequently analyzed to uncover recurring issues and potential avenues for further automation.

Q: What caution does Westpac propose when using AI for infrastructure automation?

A: Westpac recommends comprehending the unique characteristics of each AI model to guarantee reliable outcomes and circumvent possible pitfalls.

Q: Does Westpac believe AI tools can lower the threshold for automation development?

A: While AI tools can aid less experienced users in developing minor automation tasks, Westpac maintains that proficient developers are still essential in creating comprehensive solutions.

Brief Overview

• State of Security Breakfast Roadshow 2026 commenced in Brisbane.
• Conducted at the Sofitel, showcasing key industry leaders and sponsors.
• Addressed vital themes and insights from the recent security report.
• Prominent sponsors included Virtual IT Group, LevelBlue, ThreatLocker, and Huntress.
• Technology leaders from CAUDIT, Cleanaway, and Australia Post took part.

Brisbane Hosts the State of Security Breakfast Roadshow 2026

The State of Security Breakfast Roadshow 2026 made its first appearance at the Sofitel in Brisbane, signifying a major event within the technology community. Orchestrated by TechBest, this gathering united notable sponsors such as Virtual IT Group, LevelBlue, ThreatLocker, and Huntress, alongside technology figures from CAUDIT, Cleanaway, and Australia Post.

Core Themes and Insights

The gathering concentrated on the latest security hurdles and remedies, providing valuable insights into the existing landscape of cybersecurity. Conversations centered on the adoption of cutting-edge technologies to improve security practices and safeguard against new threats. Sponsors and tech authorities exchanged views on effective risk management and innovations in security.

Expert Insights from Industry Leaders

Representatives from the sponsoring firms and participating organizations provided significant insights. Virtual IT Group stressed the significance of cloud security, while LevelBlue presented advancements in network security. ThreatLocker and Huntress underscored the necessity for strong endpoint protection and threat intelligence.

Technology leaders from CAUDIT, Cleanaway, and Australia Post shared their experiences and approaches to overcoming cybersecurity challenges in their fields.

Conclusion

The State of Security Breakfast Roadshow 2026 in Brisbane proved to be highly successful, serving as a stage for tech leaders and sponsors to exchange their expertise and methodologies for confronting cybersecurity issues. The event highlighted the necessity of collaboration and innovation in strengthening security frameworks across diverse industries.

Q&A Segment

Q: What was the primary emphasis of the roadshow?

A: The roadshow primarily emphasized discussing the most recent cybersecurity challenges, solutions, and technological advancements to bolster security procedures.

Q: Who were the principal sponsors of the event?

A: The principal sponsors comprised Virtual IT Group, LevelBlue, ThreatLocker, and Huntress.

Q: Which organizations engaged in the discussions?

A: Technology leaders from CAUDIT, Cleanaway, and Australia Post engaged in the discussions.

Q: What were some of the major themes tackled during the event?

A: Major themes included cloud security, innovations in network security, endpoint protection, and threat intelligence.

Q: How did the roadshow benefit those involved?

A: Participants received valuable knowledge regarding effective cybersecurity strategies and the latest technological advancements to defend against emerging threats.

Overview

• NAB unveils NAB Nexus, a centralized operations hub for threat intelligence.
• The hub combines technology, cyber security, fraud, payments, and physical safety.
• Key objectives include real-time threat detection and response.
• NAB Nexus is designed to stay ahead of threats enabled by AI.
• The hub operates 24/7 for ongoing surveillance and quicker reactions.

NAB Nexus: A Centralized Operations Hub for Threat Intelligence

Andrew Irvine at the NAB Nexus hub (Image credit: Andrew Irvine/LinkedIn)

Real-Time Threat Detection

NAB has launched NAB Nexus, an innovative centralized operations hub focused on real-time identification of threats and threat actors. CEO Andrew Irvine remarks that this hub unifies the bank’s “frontline responders” across multiple critical areas such as technology, cyber security, fraud, payments, and physical safety.

Cross-Domain Integration

Chief Security Officer Sandro Bucchianeri underscored the importance of intelligence sharing across diverse domains. “Threats don’t fit neatly into one category,” Bucchianeri stated. The merging of various security functions is essential for the effective identification and mitigation of threats. A scam attempt could quickly intertwine with fraud incidents, cyber threats, or payment concerns.

Threats Enabled by AI

As criminals exploit AI technologies for large-scale operations, NAB Nexus is crafted to keep the bank ahead of swiftly changing AI-enabled threats. Irvine pointed out AI’s dual nature, highlighting that while it provides numerous advantages, it also heightens the capabilities of cybercriminals.

Continuous Operations for Improved Security

NAB Nexus will function continuously to guarantee constant oversight and a well-coordinated response to threats. Its around-the-clock operations are designed to enable swifter handovers and decision-making, ultimately boosting the bank’s capability to safeguard its clients and maintain security.

Conclusion

NAB has formed the NAB Nexus hub to streamline its security operations, emphasizing real-time threat identification and mitigation. By integrating numerous security domains and utilizing AI technologies, NAB Nexus seeks to deliver strong protection against advancing threats and enhance customer safety.

Questions & Answers

Q: What is the primary function of NAB Nexus?

A: The primary objective of NAB Nexus is to detect and address threats in real-time by integrating various security operations within technology, cyber security, fraud, payments, and physical safety.

Q: In what way does NAB Nexus tackle AI-enabled threats?

A: NAB Nexus aims to stay proactive against AI-enabled threats by utilizing AI technologies to bolster detection and response capabilities, while also acknowledging AI’s potential to assist cybercriminals.

Q: How is NAB Nexus different from earlier security approaches?

A: Unlike conventional security approaches, NAB Nexus offers a unified strategy that integrates various security domains, facilitating more effective intelligence sharing and a synchronized response to threats.

Q: What advantages does the 24×7 operation of NAB Nexus provide the bank?

A: The 24×7 operation guarantees uninterrupted monitoring and quick threat detection, promoting faster decision-making and coordination in response to security incidents, thus enhancing overall security for the bank and its clients.