Securing the nation: Accelerating government cyber security in an age of digital disruption

Australia’s government agencies are operating in an increasingly volatile and contested cyber environment, where threats are becoming faster, more sophisticated and harder to predict. At the same time, agencies are being asked to strengthen resilience across complex and often ageing technology environments, manage legacy systems, and prepare for emerging risks including AI-enabled attacks and the future impact of quantum computing. 

This session will explore the urgent shift required — from static, compliance-based security to a more dynamic, risk-informed and operational model of cyber resilience.

The Current Posture:​​Progress and Persistent Gaps

Recent findings from the 2025 Commonwealth Cyber Security Posture Report show that while progress is being made, significant gaps remain. Only 22% of entities achieved overall Maturity Level 2 across the Essential Eight mitigation strategies in 2025 — up from 15% in 2024, but still below the 25% achieved in 2023. Adding to the challenge, 59% of organisations continue to cite legacy ICT as a barrier to Essential Eight implementation, highlighting the technical debt that continues to constrain cyber uplift.

Beyond Compliance: Addressing Systemic Barriers

This session will look beyond the headline statistics to unpack the deeper structural barriers impeding cyber uplift across government, including:

• Point-in-time auditing

Annual, paper-based audits provide only a static snapshot of security posture. They often measure documentation and compliance rather than how controls perform in real-world conditions. This can create a false sense of assurance between audit cycles.

• Limited real-time visibility

Many agencies lack continuous monitoring across assets, configurations, user activity and threats. Without real-time observability, risks may only be detected after an incident or formal audit.

• Funding and budget process constraints

Government approval and budget cycles are often too slow and rigid for the pace of cyber threats. Funding models tend to favour one-off capital projects rather than continuous, adaptive cyber investment. Urgent preventative uplift can be delayed until systems are already compromised.

• Challenges with Essential Eight implementation

Many agencies continue to struggle to achieve Maturity Level 2. The framework can sometimes drive a compliance mindset rather than continuous risk management. It may not fully reflect modern cloud, SaaS and identity-centric environments.

• Legacy and end-of-life ICT

Older systems are harder to patch, monitor, secure and modernise. Legacy technology prevents many agencies from implementing stronger controls. It increases technical debt, slows recovery, and creates exposure to emerging threats.

• Fragmented uplift across jurisdictions

Cyber maturity and policy implementation vary across Commonwealth, state and territory governments. Shared service arrangements can limit agencies’ ability to independently improve security. Inconsistent standards create gaps in national resilience.

• Low incident reporting

Reporting of cyber incidents to ASD remains too low. Under-reporting reduces situational awareness and weakens coordinated response capability.

• Workforce capability shortages

Cyber skills shortages continue to constrain uplift. Governments face ongoing challenges attracting, retaining and upskilling cyber talent.

Insightful and practical, this session offers a forward-looking perspective on how government can translate policy ambition into system-wide resilience.