Webinar Recording: The Cyber Confidence Gap

Ashwin Pal:

This is quite interesting.

I've been a practitioner for close to 30 years now, and one of the questions I've had throughout my entire career is: how much money do organisations spend on cyber security?

Generally, it's represented as a percentage of their IT budgets.

Finally, we've got an answer.

The graph on the left-hand side is quite interesting. We're looking at about 9% to 15% of IT budgets being dedicated to security.

Larger organisations actually spend more. You can see the breakdown underneath that, and the numbers are significant, which shouldn't be a surprise given how serious cyber security threats are and, with AI and other factors, how that seems to be getting worse.

The key takeaway is that this is what your peers are spending.

If you're spending more, maybe you're on a maturity journey and aren't quite there yet, which makes sense.

If you're spending less, maybe you're already mature and are in the maintenance phase.

But if neither of those explanations holds true, then questions need to be asked about whether your spending is appropriate.

The data on the right-hand side supports what I discussed earlier around the increase in cyber security budgets, which again shouldn't come as a surprise to many people

05:47–07:19

Ashwin Pal:

This was quite an interesting finding as well.

We've got some data showing what the top end of town is doing, so to speak.

Unsurprisingly, larger organisations tend to have pretty large teams.

Sixteen or more cyber security professionals is not a small number.

A lot of them are also using a combination of on-premises and cloud-based cyber security solutions, which aligns with the hybrid model they're operating.

I haven't come across a customer in the last six, seven or eight years that isn't operating a hybrid environment, where there's still some infrastructure on-premises, although very little now, with the majority living in the cloud.

What was interesting was the statistic on the right-hand side.

Some 60% of large organisations have a centralised identity and access management system.

That's important because it's what holds the keys to the kingdom.

However, we found that number increases to close to 70% when it comes to mid-tier organisations.

That caught us by surprise because we were expecting it to be the other way around.

It's interesting to see that scale doesn't always equate to maturity and investment.

07:19–09:57

Ashwin Pal:

Delving a little deeper into that, unsurprisingly, the bridge to acquiring capability for mid-tier organisations rests with outsourcing.

A lot of mid-tier organisations may not need full-time staff for a variety of reasons.

What they're doing is using outsourcing and staff augmentation to bridge the gap between what they need and how much budget they have.

The graph on the right-hand side is quite interesting.

We found that the top two functions organisations outsource are cloud security and threat intelligence.

Again, the nature of security in the cloud, which is largely provided by or easily acquired through cloud providers themselves, and threat intelligence being externally available, lends itself towards outsourcing.

Now, what does that mean?

We've seen a lot of third-party breaches happen recently.

Pretty much every large breach we've seen in recent times has had a third-party element to it.

As a result, various organisations, including our own Australian Cyber Security Centre, have released some practical guidelines around managing third-party risk.

Three of those are noted here.

First, making sure we conduct proper and thorough due diligence before onboarding vendors.

Second, making sure contracts are properly written, with cyber security expectations and obligations embedded within those contracts.

And third, regular audits and assessments.

When we engage with third parties, it can't be a set-and-forget arrangement, particularly for critical third parties.

We need to ensure that whatever we expect from them is constantly being delivered.

If you look at things such as APRA CPS 230 and the SOCI Act, these compel organisations working with third parties to ensure those third parties are secure.

Obviously, you can delegate responsibility, but not accountability.

That accountability remains with your organisation, and you need to make sure the data that third parties are managing on your behalf remains secure.

I'll now turn it over to Darren to walk us through some of the other data from the survey.

09:57–12:28

Darren Booth:

Thanks, Ashwin.

The next finding is around the consideration that cyber security is not just a technology problem.

It's very much about people, processes and technology working together.

Organisations need to ensure that their technologies are protecting their information and being used to detect issues, but their processes and people need to work in tandem with that.

When things are identified, processes need to work to respond to them, and people need to know what they should do in those circumstances.

It's about making sure people aren't the weakest link in the organisation when it comes to cyber security.

Interestingly, what we found from the results was that, as organisational size increased, there seemed to be more difficulty bringing people along on that journey.

That includes having people with the right skills and understanding the right processes that need to be followed.

The graph on the right indicates that for organisations with more than 1,000 employees, only 28% were undertaking resilience training for their staff.

For smaller organisations, those with 200 to 1,000 employees, that figure was 46%.

Whereas, if you look at some of the threat detection and response controls, those numbers stayed relatively consistent regardless of organisational size.

The key takeaway for us is that governance is important when it comes to cyber security.

It's not just about having the latest fancy tool or technology that keeps you secure.

It's about making sure your people and processes are aligned with that technology and that they grow as your organisation scales.

Some of the complexity with larger organisations comes from more complicated governance arrangements and organisational structures.

12:28–15:47

Darren Booth:

When we start looking at where AI is being governed, again, what we find is that AI governance is a key question for organisations.

Whilst most people have, or are building, security around AI and making sure their AI systems have the same controls in place as their other systems, the governance that goes along with that is complex.

What we found from the results is that organisations that have experienced ransomware attacks or demands in the past year are also the ones that seem to be lagging behind in relation to AI governance.

That probably goes into the complexity of some organisations.

What we're finding is that organisations are struggling with how they actually govern AI as a new system.

It's a system where some responsibility sits with third parties and some sits internally.

How do you get non-technical and technical people coming along on that journey within your organisation?

How do you use AI securely?

How do you implement controls that everyone can understand and follow?

It's really about bringing people along on that journey and ensuring the tools and technologies are being used in the right way.

The findings from the survey indicate some of those complexities.

They echo some of the recent messages from ASIC and APRA, including letters to regulated entities highlighting that governance is not keeping pace with the implementation and use of AI.

There is also guidance from the Australian Institute of Company Directors and the Australian Signals Directorate around how boards and directors can understand AI governance and the key questions they should be asking.

I'd encourage anyone interested to look at that guidance.

It's not only for boards.

If you're a founder or an executive within an organisation, you can use those questions to probe whether you're doing things properly.

Do you have the right coverage and capabilities to implement AI consistently across your organisation?

Or are you exposing yourselves because you don't really know what's happening and how AI is being used?

15:47–20:21

Darren Booth:

I think a lot of this comes back to the gap we found in the survey between the confidence organisations have and the reality of what's happening.

The confidence gap has led to organisations investing more in things such as cyber insurance.

We've definitely seen an increase compared with the survey we conducted in 2024.

Cyber insurance was already being used in 2024, but more organisations now see it as a key part of their mitigation strategy to manage some of the gaps they have.

But it's really about organisations challenging themselves on what they think they have versus the reality of their controls.

Have they asked themselves those tough questions?

Have they recently undertaken a penetration test?

Have the penetration test results been escalated and communicated throughout the organisation?

It shouldn't just be a technical report that sits with IT.

The technical detail can stay with the technical teams, but the summary of findings and accountability for remediation are things non-technical people can be involved in.

That can happen through executive and board-level reporting.

You should be able to say: these are the issues we've found, these are the actions we're going to take, and this is when those actions will be completed.

If there's slippage, people should be held accountable for why it's happening.

It's also about not taking things at face value.

If someone says, "We've got all these great controls implemented and everyone's doing the right thing," challenge that.

Who's validated it?

Have you had an independent assessment to determine where you actually are?

Has someone come in, kicked the tyres and said, "You say this is what you've got. Prove it to me. Show me the evidence"?

And let's not just look at how things are today.

What have they been like over the past six months?

Are the controls operating consistently across different parts of the organisation?

Or are there inconsistent practices over time and between different departments?

Really challenge that and ask people to show you, rather than just tell you.

The last point is around testing your readiness.

There may be confidence, but the survey is definitely showing that breaches are still happening.

One in five organisations has experienced a breach.

Around 30% of organisations are facing ransomware attacks or demands.

How have you tested and simulated your readiness for that?

This comes back to the people side again.

Look at how people respond, not just how systems respond.

Take people outside the usual environment and say, "This system has been breached, or this control has failed. How do you now respond?"

Practise that in a war-game situation or simulation.

Test how people would deal with a real-life event so that when something actually happens, it isn't the first time they're experiencing it.

There's readiness and training that comes from those exercises, which people can then apply in a real-world situation.

20:21–26:58

Darren Booth:

If we were to identify three things organisations should take away from this, they really draw on what Ashwin and I have presented today.

The first is to test yourselves.

Don't just assume that your maturity, sophistication and control effectiveness are what you think they are.

Test them. Prove them.

Whether that's a penetration test, benchmarking against secure configurations or an assessment against a security framework, such as the NIST Cybersecurity Framework or the Essential Eight, ask those questions.

• How do we benchmark ourselves against others?
• What evidence do we have of our security maturity?
• What were the findings from our assessments?
• Use that as an opportunity to improve.

It should be less about a policing exercise or scorecard and more about identifying areas where you can do better.

Cyber security doesn't stand still.

Every day, a new vulnerability is found or a new way of attacking a system emerges.

If you're an organisation that's standing still, you're actually moving backwards in terms of your maturity and the effectiveness of your cyber security controls relative to others.

The next priority is assessing your security posture.

Ask the tough questions internally.

Are people taking accountability and responsibility for security in their respective areas?

If you see people deflecting responsibility, that can be an indicator that governance around security is starting to fall away.

The people side of your security may not be as strong as you think.

If a lack of accountability is slowing decisions, and governance is getting in the way of making improvements or using investment effectively, then you need to challenge how your governance, processes and people are working.

Having a cyber security strategy with a clearly outlined roadmap, timelines and expected benefits is important.

Use that as a benchmark.

If you're not meeting your objectives, ask why.

There may be valid reasons, but if you're not asking those questions, you're not challenging whether your investments are delivering the improvements you want.

Finally, there's the people side.

Don't be afraid to test your people.

Get involved in simulations.

We often see simulations at either end of the spectrum.

Sometimes they're exercises involving lower-level staff without executive participation.

Other times, they're executive-only simulations without people on the ground.

Both have value, but if you're not bringing those groups together, including third parties, you're missing an important part of your organisation's readiness.

You need to test what third parties are doing for you and understand everyone's role during a disruption.

That brings me to the importance of prioritising third parties, which Ashwin discussed earlier.

We continually see supply-chain attacks.

You need to see third parties as an extension of your own organisation.

If you're implementing security controls, testing those controls and holding yourselves accountable for improvements, you need to do the same for your third parties.

Make sure you're testing them during onboarding.

Then, annually or every two years, ask where they are on their cyber security journey.

But also get them to prove it.

Do they have a certificate or assurance report?

If not, ask them the tough questions and request evidence.

You want to make sure they're coming along on the journey with you, rather than becoming the weakest link.

If you're making improvements and they aren't, that's a problem.

They should be at or ahead of your level, particularly if they're providing specialist services.

It's about getting evidence, challenging yourselves and others, and closing the gap between where you think you are and the reality of your cyber security practices.

That essentially summarises the findings we've presented from the report.

We're keen to hear any questions about what we've discussed or challenges that people are facing in their own organisations.

I'm presenting, so I can't see all the chats. Darien, have any questions come through?

26:58–28:10

Darien Canepa:

I can see someone has their hand raised. If you've got a question, perhaps put it in the chat so we can pick it up and answer it for you.

In the lead-up to Cyber Security Awareness Month, we've also had a few questions coming through from industry.

One of them is: where are you seeing the greatest investment?

28:10–31:03

Ashwin Pal:

Maybe I'll jump into that.

We're continuing to see organisations invest in protective technologies, the usual solutions such as CrowdStrike, for example.

But what we are seeing is a shift towards greater investment in resilience.

When things go wrong, how do we respond?

We're seeing investment in incident response, incident response retainers, crisis management training and similar capabilities.

If you look at the NIST Cybersecurity Framework, organisations are continuing to invest in the Protect function.

But Respond and Recover, in particular, are receiving greater investment.

So is governance.

As you can probably tell, I do love my NIST Cybersecurity Framework.

That increasing governance investment has largely been driven by greater internal awareness and regulatory pressures from frameworks such as the SOCI Act and APRA requirements.

Darren, what are your thoughts?

Darren Booth:

I think there's definitely ongoing investment in the Protect function.

We're also seeing more maturity on the detection side.

Organisations are spending money trying to evolve and improve their security operations centres.

It's about taking those capabilities to the next level.

Not just detecting issues, but knowing what to do when detections occur and being smarter about the response.

AI brings both a threat and an opportunity to cyber security.

There's definitely a threat from AI-based attacks, but there's also an opportunity to invest in AI internally to make detection processes smarter.

The MITRE ATT&CK framework has been around for a long time.

It's a very complicated framework for smaller organisations with limited budgets.

But now you can start investing in AI agents that are smarter at using some of the detection methods outlined in that framework.

These tools can help identify threats and implement controls that align with those approaches.

MITRE ATT&CK is a great framework, but it can be difficult for small and medium enterprises to get their heads around.

AI presents an opportunity to make those capabilities more accessible.

31:03–34:27

Darien Canepa:

Thank you. We've had another question here.

What are the bare minimum critical controls you'd expect line one and line two to be testing to give boards and executives the assurance they need?

Ashwin Pal:

Maybe I'll jump in. I'm a big fan of the Essential Eight.

In terms of bare minimum critical controls, I'm a big proponent of getting to maturity level two.

Obviously, maturity levels zero and one have different meanings. What we've found is that maturity level two will protect you against a commercially focused hacker. That's not necessarily every organisation's key vulnerability, but for most organisations, it offers appropriate protection against common threats. That's the simple answer from my perspective.

Darren, your views?

Darren Booth:

I think the three lines of defence can be an interesting one. Yes, there are controls, but there's also context around those controls. Do you actually know what technology systems you have? Do you know what your attack surface looks like, both externally and internally? There are lots of organisations with really nice control frameworks that tick all the boxes. They might say, "Yes, we think we've got multi-factor authentication. We think we've got privileged access under control." And perhaps that covers 95% or 96% of their systems.

But there are still other systems out there that aren't covered. That context is always important.

You need to know what systems you've got and where your crown jewels are. Then apply a prioritised approach.

You don't necessarily need top-end cyber security on every single system, but you do need it on systems that are critical.

You need the right separation and segmentation of systems to ensure your important assets, systems and data are appropriately protected.

That's an important stepping stone before implementing controls outlined in security frameworks.

For me, it's not always about diving into the latest and greatest tool or control. It's about understanding your technology landscape. Know your risk universe. Know your systems, your assets and your attack surface.

Then apply the appropriate controls to that context.

Make sure you're directing your efforts to the right areas, rather than spinning your wheels thinking you're doing the right thing.

Darien Canepa:

Great, thank you.

Our next question is: with AI making cyber attacks more sophisticated, scalable and accessible, are traditional cyber security strategies becoming obsolete?

And will AI ultimately give cyber criminals a greater advantage than the organisations trying to defend themselves?

Ashwin Pal:

I'll have a crack at that.

First, traditional strategies are not necessarily becoming obsolete.

If you look at some of the recent AI-related cyber attacks, they've exploited vulnerabilities in systems.

They've also used techniques such as credential stuffing.

The strategies for protecting against those attacks, such as keeping systems patched, using multi-factor authentication and so on, still apply.

The paradigm shift with AI is that it's happening faster, at machine speed.

The attacks are also becoming more accurate because machines are better at certain tasks.

So AI has increased the need for speed and diligence around those strategies, rather than necessarily replacing them.

I think there was a second part to the question, Darien.

Darien Canepa:

Yes. Will AI ultimately give cyber criminals a greater advantage than the organisations trying to defend themselves?

Ashwin Pal:

It will if you're not staying in touch with how attacks are evolving and how the threat landscape is changing.

It will also be an issue if you're not using AI yourself.

AI is already built into many cyber security tools.

If you're not using AI to your advantage and you're not moving with the times, then yes, cyber criminals could gain an advantage.

If you are keeping up, you give yourself a good chance of using AI for good rather than bad.

Darren?

Darren Booth:

I agree.

The evidence seems to suggest that traditional security controls still apply to AI.

There are definitely some new considerations around how models are trained, model poisoning and prompt poisoning.

But some of those risks exist in slightly different forms in traditional systems.

It's about applying traditional controls through a different lens and considering how those controls apply to an AI system.

To Ashwin's point, what we're seeing is that AI simply moves faster.

It moves faster at exploiting vulnerabilities that already exist.

Therefore, organisations need to move faster.

Gone are the days when you could have a patch available and be comfortable waiting two or three weeks to apply it.

Once you've got a patch for a vulnerability, you need to apply it quickly.

Another interesting aspect from an attack perspective is that AI is very good at joining together lower-rated security findings.

Those vulnerabilities may have been known for a while.

People are aware of them, but it can be difficult for a human to connect all the dots because it's so time-consuming.

AI can connect those findings to create a critical attack path that previously would have been too difficult for someone to identify.

So traditional controls, such as patch management, now need to consider both speed and coverage.

Historically, people might say, "That's a low-rated vulnerability. We'll get around to fixing it."

The reality is that sometimes they never do.

We're starting to see those vulnerabilities receive greater priority because organisations now need to fix them to mitigate the types of chained attacks AI can enable.

So the controls aren't necessarily new, but how they're applied is changing.

That also affects the governance you place over your security landscape.

You need to ask questions differently and challenge your technology teams and business leaders.

For example, if applying a patch requires a system to go down for two hours, organisations need to be willing to make that decision.

Alternatively, they need to invest in additional resilience so they can apply those changes without unacceptable disruption.

These considerations may not have been such a high priority historically, but they are becoming increasingly important.

39:28–42:52

Darien Canepa:

Great, thank you.

We've got another question here.

Are there core IT security skills and knowledge that should be developed and maintained in-house?

Ashwin Pal:

Good question.

I wouldn't necessarily say those skills have to be in-house or outsourced, so long as you have access to the basic capabilities.

I'd put a slightly different perspective on that and focus more on risk management.

Going back to what Darren said earlier, you need to know what you're trying to protect.

What are your critical assets?

You need to understand the threat landscape, the threats and vulnerabilities you're exposed to, and your organisation's risk appetite.

Once you know all of that, you need to understand how your current security posture compares with your risk appetite.

What's your current state, and what do you need to do to get where you need to be?

It's about improving your security maturity to a level where your exposure is within your organisation's risk appetite.

Another thing to understand is that you'll never be able to buy your cyber risk down to zero, or any risk for that matter.

You need to understand what residual risk remains.

That can then help drive the cyber insurance conversation.

You're effectively transferring some of that residual risk to a third party.

If you think about what I've just described, those are fairly fundamental skills needed to manage your cyber risk posture internally.

There's also a very strong connection between cyber risk management and cyber security management.

Darren?

Darren Booth:

I think the key thing to remember is that whether you've got an in-house team or an outsourced team, they'll be responsible for applying some of the security controls.

But ultimately, the organisation is accountable for what's being done.

Regardless of where the technical people sit, whether that's internally or externally, management needs the skills to ask the right questions.

They need to challenge people, hold them accountable for improvements and make sure the investment being made internally or through third parties is getting the organisation where it needs to be.

Executives and directors need to understand that governance layer.

They need to ask the right questions and ask for evidence to support where cyber security teams believe they sit in terms of maturity.

That's a key capability every organisation needs.

It enables leaders to challenge assumptions and ensure the organisation is progressing on its cyber security journey.

42:52–46:56

Darien Canepa:

We've got a couple of other questions that came through during the month.

What are the key threat vectors you're seeing?

Ashwin Pal:

If I look at what's been published and the work we've done, I'd probably highlight three main areas.

First, ransomware is still massive. That's purely because it's effective and the barrier to entry is relatively low.

Second, exploitation of system vulnerabilities.

Again, that's often because organisations aren't great at patching. It's not necessarily because they don't want to do it. There can be other reasons.

For example, patching a system might break it, or operational technology systems may be difficult to patch. But those vulnerabilities continue to be exploited. Third, identity theft and credential stuffing.

Those remain significant problems.

Unfortunately, even now, it's still relatively easy to phish people and obtain their credentials. Organisations also aren't consistently implementing additional authentication factors to help secure those credentials.

That would probably be my summary.

Darren, your thoughts?

Darren Booth:

I think that last point is particularly important. It probably hasn't changed much over the past few years. It still comes back to the people side of cyber security. How do organisations help their people secure systems?

How do they make sure passwords are used securely and aren't reused across other systems? How do they ensure people have the right training to avoid phishing attacks and malicious links?

You can have all the technical controls you want and spend significant amounts of money on them. But if there's a targeted attack against an individual, those controls won't necessarily stop or detect every malicious attack.

That includes targeted phishing or malicious links. Another change we're seeing is what happens once an attacker gets inside an organisation. As Ashwin mentioned, ransomware is still a major threat. But it doesn't necessarily happen immediately anymore.

A couple of years ago, once someone gained a foothold inside an organisation, they might deploy ransomware as quickly as possible. Now, attackers may take more time. They work out what tools the organisation uses. They use those same tools to investigate the environment, identify data and understand how systems operate. That can make the organisation's detection capabilities less effective.

The attackers may stay inside for a couple of months before deploying ransomware. That's been a change over the past few years. Attackers have become more patient. It also gives them additional opportunities beyond ransomware. They can exfiltrate data, identify confidential company information and use that knowledge as another form of extortion. So it's no longer simply about locking down systems.

It's about using information and access to place additional pressure on organisations.

46:56–50:13

Darien Canepa:

Thank you, Darren.

How do organisations close the gap between confidence and reality when budgets are constrained?

Darren Booth:

I'll take that one.

It's a good question.

Budget constraints definitely make things harder.

Going back to one of the slides Ashwin discussed at the beginning, if you're at the lower end of the scale in terms of technology investment and the percentage of that technology spend allocated to cyber security, you're going to face challenges.

You need to determine how to spend a finite amount of money in the right way. For budget-constrained organisations, there are some good self-assessment tools and free, open-source tools available.

The Australian Signals Directorate has tools organisations can use. They're free and can be run within your own environment relatively cheaply. There's obviously some resource effort involved, but those tools can benchmark your organisation against areas such as application whitelisting and secure hardening.

You can also benchmark against the CIS Controls relatively cheaply. I think using those opportunities to test yourselves is a good way to use your budget wisely. It's better than simply trying to buy the next big tool.

Testing can help you target your next investment based on what you actually need.

That's particularly valuable when both your security and technology budgets are constrained.

Ashwin Pal:

Just adding to that, I think some of the data from our survey supports using outsourcing and external expertise to bridge capability gaps. Large organisations often have the budget and need for full-time teams. We saw data showing teams of 16 or more security professionals in some organisations.

But mid-tier and smaller organisations may not need or be able to afford those resources. That's where external support can help. You can acquire what you need and nothing more. Services such as virtual CISO arrangements can help organisations understand their maturity and improve it over time. It's really a combination of the tools Darren mentioned and accessing the right expertise.

That way, you can make the best use of the tools and resources available.

50:13–55:27

Darien Canepa:

Thanks, Ashwin.

We've got one last question here. There have been fines recently related to poor cyber security controls.

What are the key lessons from those?

Darren Booth:

I assume that's referring to the three court cases we've seen over the past couple of years. There have essentially been three instances where organisations have been taken to court by ASIC.

In the first case, there was no actual fine, but the organisation was ordered to pay ASIC's costs, which I think were around half a million dollars. In the second case, there was an actual fine as well as costs. And in the last month, there has been a third case. Each is slightly different.

The most recent one is particularly interesting.

It involved an Australian Financial Services Licence holder. It wasn't the licence holder itself that experienced the breach. It was one of its representatives. Because that organisation was a representative operating under the licence, the licence holder was taken to court over security breaches at the representative. The penalty related to the lack of appropriate controls at that representative. The key lesson for me is recognising that the potential impact isn't limited to your own organisation. 

It extends to interconnected organisations. If you've got third parties in your supply chain that operate under your licence or perform services on your behalf, you're still ultimately accountable for their security controls.

If you're not asking the right questions, testing them and helping them improve their security, that can become a significant issue. For example, if you've got a representative under your licence, you may have obligations to ensure their people receive appropriate training and that minimum security standards are maintained.

Accountability doesn't just stop with your own organisation. It can extend to other organisations you have relationships with. The second case was probably more of a governance issue. The organisation had undertaken security testing.

Those tests identified weaknesses. It had also experienced breaches, and those incidents identified remediation actions. The recommendations clearly said that certain controls needed to be implemented. But they weren't. The issues were escalated again, identifying that the controls still hadn't been implemented. From a governance perspective, the organisation didn't take the matter further. It didn't implement the necessary controls or allocate the appropriate budget, resources and effort. 

A subsequent breach occurred. The penalties were really about the lack of governance, rather than necessarily the absence of controls themselves. There's a recognition that no organisation can have a perfect cyber security control environment. It's a maturity journey.

But if you're told you have gaps and you don't take action to address them, that's a fundamental governance issue.

Organisations should be able to manage those responsibilities. That comes back to the survey findings and the gap between confidence and reality. If you discover an issue, you can't just sit there and do nothing about it.

You need to act and close those gaps. Ashwin, is there anything else you want to add?

Ashwin Pal:

The key takeaway I'd add is that people are getting fined, and the fines are becoming real.

We've now seen three examples.

I fully expect that unless organisations change and become better prepared to address these issues, the problem will only get worse. That applies to ASIC and other regulators as well.

For most organisations, the fine itself may actually be less of an issue than the reputational damage. It's what those incidents do to how customers perceive you and whether they want to continue dealing with you. It's really about understanding the legal and regulatory landscape and being able to respond appropriately.

55:27–56:44

Darien Canepa:

Thank you, Darren and Ashwin, for sharing those insights today.

That was our last question, and it brings us towards the end of today's webinar.

Are there any other remarks you'd like to make before we wrap up?

Ashwin Pal:

You've got the QR code, so please download the report and have a look.

This is an evolving landscape, so it's important to stay on top of things.

Darren?

Darren Booth:

I'd also encourage everyone to complete the self-assessment available through the link.

If you weren't involved in the original survey, you can benchmark your organisation against the survey results.

It takes about five to ten minutes and provides some tangible outputs.

Please feel free to access the report and complete the assessment.

Thanks.

Darien Canepa:

Yes, in the next few days, we'll be sharing the recording and links to our Cyber Security Awareness Month page, which includes the self-assessment and report.

Thank you for joining us today.

If you have any further questions, please feel free to reach out to Darren or Ashwin.

Thank you, everyone.

Enjoy the rest of your day.

Ashwin Pal and Darren Booth:

Thank you.