The paradox of regulating cybersecurity?

Cybercrime losses in Australia totalled 33 billion in 2021. The government responded by committing 15 to $20 billion to cyber capabilities. Globally, 177 countries have enacted data protection laws and 110 have implemented cybersecurity frameworks. Organisations are more regulated than ever. Yet breaches continue to rise. So, is all this regulation working?

The evidence says yes, but with a significant caveat. Research shows highly regulated industries outperform low-regulated ones by nearly 200%. Regulation drives adoption even without explicit mandates. But compliance alone breeds a checkbox mentality that does not translate into genuine security. Organisations pass audits while vulnerabilities persist. They have the right pieces on the chessboard. Nobody checks how well they play chess.

This presentation shares preliminary findings from PhD research at the University of Melbourne investigating how supervisory partnerships between regulators and regulated entities can enable cybersecurity uplift beyond compliance. We conducted 14 semi-structured interviews with regulators, regulatees, and dual-perspective participants across regulated sectors.

The core finding challenges a widely held assumption: that partnership and enforcement sit at opposite ends of a spectrum. They do not. Partnership is not the opposite of enforcement. Partnership is a quality of how supervisory activities are enacted, including enforcement. Two regulators can issue the same findings letter. One picks up the phone, explains the finding, and follows up to ensure they are actioned. The other sends a letter. Same action. Different relationship. Different outcome.

From the data, we identified five attributes that constitute Supervisory Partnership Quality (SPQ): trust, communication, proportionality, competence, and enablement.

We also found that regulators move between justice-oriented and care-oriented approaches depending on the supervisory activity. The orientation can flex. The quality cannot.

These attributes inform a diagnostic matrix that maps supervisory relationships across four quadrants, from transactional regulation and disconnected engagement to structured and relational partnership. Both partnership quadrants are expected to produce uplift. The differentiator is not whether the regulator is strict or supportive. It is whether SPQ is high.

Attendees will leave with a practical lens to diagnose their own supervisory relationships, an understanding of what drives partnership quality, and an appreciation for why enforcement and partnership are not competing priorities. This research is ongoing and practitioner-informed. It started with practitioners. It needs practitioners to finish it.