When the playbook burns: AI accelerated incidents and the response gap killing Australian organisations

Your incident response plan was written for a world that no longer exists. 

When AI augmented ransomware struck a major Australian financial institution in 2025, their carefully rehearsed runbook became operationally irrelevant within the first 90 minutes. The attacker moved faster, pivoted across third-party systems the CIRP had never modelled, and triggered simultaneous regulatory notification obligations the IR team had not rehearsed end-to-end. This is not an isolated story. Across financial services, energy, healthcare and retail supply chain, the same gap is emerging: between documented IR capability and actual performance under AI-era attack conditions. This session is about closing it.

Drawing on anonymised incident response engagements across Australian financial services, critical infrastructure, healthcare and retail and against the binding obligations of the Cyber Security Act 2024, SOCI Act, CPS 230 and Privacy Act NDB scheme, this session exposes the systemic failure points that determine whether Australian organisations recover from major cyber incidents or are broken by them. It moves beyond framework and theory to examine what actually happens in the first 24, 48 and 72 hours of a live AI-augmented incident: where coordination breaks down, where executive decision-making fails, where regulatory obligations conflict with operational priorities, and what genuinely effective response looks like when it has been tested under real conditions.

Why this matters now:

Australia has experienced an unprecedented volume of high-impact cyber incidents through 2024 and 2025. AI augmented attacks have moved from emerging threat to operational reality across every sector. The Cyber Security Act 2024's mandatory ransomware payment reporting commenced in 2025. CPS 230 is now in force, making operational resilience and BCP testing a binding regulatory obligation for APRA regulated entities. SOCI's 12–72 hour notification timelines are live. 

Organisations that fail to close the gap between Incident Response (IR) policy and operational performance now face regulatory consequences, reputational damage, customer harm and for directors potential personal liability. This session provides the cross-sector, evidence-based perspective that organisations need to honestly assess and strengthen their actual readiness.