Safety not guaranteed: What ransomware victims have in common with 1970s construction workers

Triskele Labs’ Digital Forensics and Incident Response team has responded to hundreds of ransomware incidents across Australian organisations of every size and sector. The pattern is consistent, the causes are familiar, and the impact is largely avoidable. What these incidents consistently show is that cyber security is no longer failing as a technical problem. It is failing as a governance issue. 

After a while, a pattern becomes impossible to ignore: the causes are almost always the same. Not advanced threats or novel techniques, but failures in controls organisations already know they should have. Multi-factor authentication, patching, identity management, endpoint detection, data retention, and network segregation. Controls that are neither new nor complex, yet consistently not implemented or enforced. 

Fifty years ago, Australian construction sites operated under the same logic. The risks were known, the controls existed, and yet workers were killed and injured with depressing regularity. Safety measures were inconvenient or expensive, and nobody with real authority made them non-negotiable. It took legislative reform, regulatory pressure, and a cultural shift to make the hardhat non-negotiable. Today, no one debates it. The executive who removes safety railings to hit a deadline is not considered pragmatic. They are considered reckless. Fifty years later, we are having the same argument about MFA and other basic controls. 

This session pairs anonymised case studies from incident response engagements across finance, healthcare, education, and government with the regulatory reality now facing those sectors. Privacy Act reforms, the SOCI Act, APRA CPS 234, and emerging federal cyber legislation are clear signals of regulatory intent. Organisations that continue to treat foundational controls as optional are not being pragmatic. They are accumulating a liability they do not yet fully understand. 

This is not another awareness session. It is a field report, a historical parallel, and a direct challenge to senior leaders to recognise their reform moment before the regulator forces it. 

Who is this for: Board members, executives, CISOs, GRC and legal professionals responsible for organisational risk and accountability.