APRA’s annual report sets out what it will check next
APRA has published its annual report for 2025-26. Most coverage will focus on the big numbers. Assets under APRA supervision passed $10 trillion for the first…
Read the article →The score is gone. ASD published the replacement on Thursday.
All year we have been saying the Essential Eight was going. We could not tell you what replaced it, or when. We said so every time…
Read the article →Responsibility without authority: the CISO role has a design fault
Something has shifted in the last few years, quietly, and it changes how the most exposed job in the business should be thought about. The accountability…
Read the article →The Reserve Bank’s language just hardened. APRA’s work plan says what comes next.
Here are three sentences from the Reserve Bank, written three years apart. Potential. Then probability. Now likelihood, and it’s rising. Central banks pick these words carefully,…
Read the article →The AI inquiry heard four days of evidence. It decided nothing. Here is what to do anyway.
The Joint Select Committee on Artificial Intelligence finished four days of public hearings on Friday. Two days in Sydney, two in Melbourne. It decided nothing, and…
Read the article →Third-party risk assumes there is a counterparty. This one had none.
On 6 October, OpenAI’s Chief Strategy Officer sat in front of an Australian parliamentary committee and said the company’s handling of a breach of Australian government…
Read the article →AUSTRAC went looking for the businesses that didn’t show up
The last piece on this was about firms that enrolled under Tranche 2, wrote a program, and assumed that was the hard part done. AUSTRAC’s own…
Read the article →When the weakest link is code you inherited.
A supply-chain compromise that reached more than a thousand organisations came in through software nobody bought and nobody chose. A questionnaire was never going to find…
Read the article →The Essential Eight is being retired. What the Essentials series changes, and what to do now.
Australia’s baseline cyber framework is being replaced over the next two years. The shift from a score to a provable position is the part to plan…
Read the article →Patch speed is not the test. The decisions that cannot wait are.
Building on a point Geoff Hancock made this week, and the part that decides whether it works in practice. TL;DR Geoff Hancock, who has been a…
Read the article →