Your SOC watches every packet. Who watches the car parked outside your substation for three days?

Every organisation in this room would notice if their SIEM went dark or their SOC had endpoints deployed but nobody writing detection rules. You would call that a fundamental failure, not because the tools were missing, but because the intelligence function behind them had never been stood up.

That is the current state of physical security across the broad majority of SOCI-regulated operators in Australia. A handful of Tier 1 entities like the major miners and defence primes have elements of physical intelligence capability. Below that tier, where the SOCI obligations are identical but the security maturity drops off sharply, the intelligence cycle is absent as an operational construct. Guards, cameras, and fences deployed without collection plans, tasking, or analytical frameworks. The physical equivalent of logging everything and reviewing nothing. A broken cycle can be repaired. An absent one must be built from scratch.

This presentation draws on original research across four SOCI-regulated sectors (mining, energy, telecommunications, and postal), examining incidents where precursor signals preceded physical attacks by one to four weeks. An honest caveat: these precursors are identified retrospectively. Any cyber practitioner knows the distance between "the indicators were there" and "the alert fired." The claim is not that a monitoring system would have caught them. It is that no collection architecture existed to try. In cyber terms, not a missed alert but a network with no sensors deployed.

Two anchor cases carry the session. In the WA Goldfields, a law enforcement intelligence unit placed a covert camera based on HUMINT and OSINT. Intelligence directed the security measure, and a man was caught angle-grinding into a gold room. In Melbourne, the GPO box room was broken into four times in eleven days. After the first intrusion, nobody asked whether they were coming back. That is the equivalent of finding an initial compromise and never scoping for lateral movement. Two further cases, organised diesel theft following the February 2026 supply disruption and fibre route sabotage on the Mornington Peninsula, confirm the pattern. The gap persists not because operators lack cyber sophistication but because physical intelligence tradecraft is a different discipline with different collection constraints, and it has not transferred organically from the domain where the investment concentrated.

The second half shifts from diagnosis to action. The tiered framework mirrors how the cyber industry already scales. Tier 1 embedded intelligence with SOC integration. Tier 2 intelligence-as-a-service mirroring managed detection and response. Tier 3 government-facilitated threat sharing modelled on ACSC. For each tier the session specifies the first capability to stand up, the governance required, and how it connects to existing operations.

Attendees will leave with a diagnostic framework and a practical entry point for extending their intelligence capability into the physical domain, because the threat landscape doesn't stop at the network perimeter and neither should the intelligence cycle.