Roundtable Recap: Cyber Security and Digital Trust

It’s an all-too-common customer conversation for Murray Mills, Head of Cyber Security at Tecala Group.

‘No, we’ve already got controls in place. It’s all fine, we’re covered.’

But in the age of securing AI, the devil is in the detail.

A policy outlining what employees should do is different to a report highlighting what the business has to do.

That seemingly subtle – but often seismic – understanding is now at the heart of corporate conversation across Australia, a new starting point on a modern security journey designed to safeguard organisations from the risk associated to mass AI adoption.

“Many businesses believe their safeguards are established, only to discover activity they cannot explain,” Mills observed. “When we show reporting and all of the activity happening with company data, that’s when the lack of awareness starts to show.”

Findings often reveal unfamiliar AI tools, unexpected use of information and employees building capabilities beyond the organisation’s formal plans or controls. This is in opposition to IT or business-led process change and consequently, increases business risk at an alarming rate.

“This raises an important question about how businesses establish confidence in their safeguards,” identified Steve Hunter, Regional Vice President of Engineering across Asia Pacific and Japan (APJ) at Arctic Wolf.

“Businesses must demonstrate that yes, they have intent, they have a policy and they have implemented it. But beyond that, evidence of effectiveness must be considered and scrutinised. Is the organisation seeing a reduction in risk?”

That widening gap between intention and evidence formed a central theme of Cyber Security and Digital Trust – an Executive Roundtable which tackled how security can become an enabler of innovation, customer confidence and sustainable business growth, beyond preventing attacks.

This exclusive session in Sydney housed CIOs, CISOs, CTOs and Directors, forming part of an Executive Insights Program – The Frontier Firm: An Australian Approach – designed to explore what it takes to build and lead a Frontier Firm in Australia.

Through independent research, executive roundtables and industry analysis, this editorial series will outline how organisations are navigating this transition, the challenges they face and the opportunities ahead.

Who owns the security decision?

“Who owns data in your organisation? Who owns the business risk?”

Murray Mills · Head of Cyber Security, Tecala Group

As organisations become increasingly digital, cyber security has evolved from a technical discipline into a board-level business priority.

The rapid adoption of cloud, AI and connected services has expanded the attack surface while increasing executive accountability for resilience, governance and customer trust.

In response, organisations are strengthening digital trust through modern security architectures, zero-trust principles, identity, resilience and operational readiness.

“This begins with the organisation itself: what it does, what it wants to achieve and which risks matter in that context,” Mills advised.

“Businesses must avoid thinking they always need a new tool to fix one discrete issue. Instead, organisations should adopt a solution approach capable of enabling AI securely within the workplace.

“Here’s the business context, here’s the business problem and here’s the business objective – then this is how to solve that from a technology solution perspective.”

Such an approach requires clear ownership and accountability of the decisions behind the technology, however.

“Who owns data in your organisation? Who owns the business risk?” Mills asked.

Technology teams can implement safeguards, but decisions about client commitments, acceptable exposure and commercial priorities require business authority. In that sense, governance must offer a clear basis for acting, including when different requirements compete.

One organisation at the discussion described an AI governance group involving board and executive representatives alongside IT. This allowed proposed uses to be assessed against both business requirements and client obligations.

Without that involvement, technology teams can be left managing the consequences of decisions made elsewhere, while executives have an incomplete view of the exposure they have accepted.

Ownership and accountability also depend on knowing how information is being used.

“As a CIO or CISO, can you identify an updated report highlighting where your data is right now and who’s got access to that data?” Mills challenged. “Can you, with confidence, advise whether or not an employee has downloaded sensitive data in one place and uploaded it in another place?”

Employees can encounter AI through external services, personal devices and capabilities appearing inside existing applications – meaning an approved platform provides only part of the picture. Leaders also need to understand what happens around it.

The discussion highlighted the practical pressures behind that activity.

For example, employees may seek another tool because they are trying to finish a task or because the approved environment cannot give them the result they need.

Improving access to useful information and making sanctioned tools work effectively becomes part of managing exposure. Restrictions are harder to sustain when the organisation has not provided a workable route to the outcome employees are seeking.

One organisation at the discussion was prioritising the clean-up of SharePoint and the consolidation of information held elsewhere, so its approved AI platform could access more of the data employees needed. The work linked information management directly to adoption: a sanctioned tool becomes more useful when people can find reliable information within it.

The human element extends beyond knowing the rules.

Staff need to understand how to apply them under deadline pressure or when a task falls outside the examples covered by a policy. Training and technical safeguards need to reflect those everyday decisions.

“The same scrutiny needs to extend to established security arrangements,” Mills added.

“You have a policy, you have a procedure, but when was the last time you actually ran through that? When was the last time that you tested that? Did the people that are involved in that process know that they’re involved and understand how they’re impacted by those certain things?”

When the tools of the trade disappear

“There is now a realisation that even non-technology businesses are still technology businesses. If your IT systems and 50-60 SaaS systems all went away, how much work and productivity could you continue doing and for how long?”

Steve Hunter · Regional Vice President of Engineering, APJ, Arctic Wolf

The discussion drew upon Tecala’s expertise helping organisations develop and implement cyber security strategies, combined with Arctic Wolf’s focus on continuously monitoring and operating business defences.

Because as Australian organisations consider where AI can improve operations, both perspectives become relevant: deciding how technology should be used, then understanding whether those decisions hold up in practice.

Hunter’s operational perspective brings another question into focus: how much of the business could continue if its technology became unavailable?

“There is now a realisation that even non-technology businesses are still technology businesses,” Hunter noted. “If your IT systems and 50-60 SaaS systems all went away, how much work and productivity could you continue doing and for how long?”

For example, a company may deliver physical products or services, yet still depend on digital systems to coordinate people, process orders, access designs and communicate with customers. Hence why operating existing security capabilities continuously is an important part of addressing that dependence.

The information at stake also extends beyond personal records.

The discussion raised pricing and proposal material as examples of commercially sensitive data whose loss could affect competitiveness. Understanding that value helps leaders assess exposure through both the services they need to keep delivering and the information that supports their market position.

“This is more about 24/7 security operations – monitoring, understanding your risk and operating that on a 24/7 basis,” Hunter added.

Building on this thread, Alex Vasilevski – Enterprise Account Executive at Arctic Wolf – confidentially illustrated the recovery challenge of one organisation that was unable to access company systems following a cyber incident.

The business had back-ups. Restoring them, however, required capacity that was not immediately available.

“They had 80TB of storage in their back-ups, but they didn’t have a spare 80GB of storage to restore to,” Vasilevski explained.

“That back-up had to be put somewhere which meant that recovery became a procurement and operational problem, as well as a technical one. The business had to procure storage, procure servers, procure that whole process. That cost the business a significant amount more than they thought – just think about the total the cost of downtime because employees are also still being paid.”

Retaining information and resuming operations are separate capabilities. A recovery plan needs to account for infrastructure, suppliers, staff responsibilities and the order in which services return.

Testing needs to cover how the business operates during recovery, including which activities resume first, what employees can do while systems are unavailable and how customers will be kept informed. Finance, operations, executive leaders and external partners may all have responsibilities, particularly where restoration depends on procurement or alternative working arrangements.

Mills brought the issue back to a straightforward question: “When was the last time you tested the back-up?”

The purpose of such checks extends beyond reducing the likelihood or impact of an incident because they also help establish where the business can confidently use new technology.

For Mills, the objective is to give employees the means to work effectively, supported by safeguards the organisation can validate.

“How can you allow your team to do what they do best while ensuring you have the security guardrails in place?” Mills asked.

Customer expectations are increasingly part of that assessment.

“It’s certainly being driven from the customers,” Mills acknowledged.

“They are the ones that are demanding, ‘I want to see your certificate. I want to see your compliance. I want to see how you align to this framework. I want to see your data protection policies.’”

The discussion included an example of different AI environments being used to accommodate different client conditions, with access determined by the customer and the individual work involved.

This creates a trade-off for organisations seeking to standardise their technology.

A common environment can simplify oversight, but different customer commitments may require carefully governed exceptions. Building those requirements into the design of a service or AI workflow gives the organisation a clearer route to accepting work and meeting its obligations.

That makes the commercial value of security concrete. Appropriate environments, permissions and governance can provide a way to deliver work within the conditions a customer requires.

“But remember that security must support ongoing improvement,” Hunter cautioned. “It can be treated like a checkbox, but if businesses instead treat it like a foundation to do work on, then that becomes a positive outcome for the organisation.”

Ensuring best practice becomes an ongoing discipline

“Security must support ongoing improvement. It can be treated like a checkbox, but if businesses instead treat it like a foundation to do work on, then that becomes a positive outcome for the organisation.”

Steve Hunter · Regional Vice President of Engineering, APJ, Arctic Wolf

The foundations themselves remain familiar: access management, monitoring, data governance and recovery planning. But what is changing is the speed and scale at which AI can discover, combine and share information.

Inconsistent permissions or poorly organised data can become more consequential as those capabilities expand. Leaders and employees also need enough understanding of AI to recognise useful applications and use them within the organisation’s safeguards.

Looking ahead, Mills advised organisations to combine planning to build digital trust through modern security, balance innovation with cyber risk and accountability and crucially, consider security as a business enabler, not a defensive capability.

“Organisations often have a business strategy, and they have an IT strategy – our advice is to consolidate and combine those strategies to ensure the required cyber security elements can be enabled,” Mills recommended.

“AI is prompting organisations to revisit safeguards they may have considered settled. AI is exposing gaps in controls that businesses thought were effective. As we change how we interact with systems, we need to revisit those controls and the risks they address.”

Therefore, the next investment decision begins with a closer examination of the present: which tools employees use, how information moves, who authorises that activity and what happens when something goes wrong.

Before leaders decide what to scale, they need to know what their existing controls are allowing to happen.

“Every business and every segment is a little bit different in terms of risk appetite and the risks that are perceived within that business,” Mills said. “What do you want out of AI enablement? What are your concerns around security?”

A practical starting point is to agree which business initiatives security needs to support, identify the gaps that could hold them back and establish a prioritised program of work.

“We have ADA – our AI, data and automation business unit that focuses on enabling AI and extracting maximum value as a business,” Mills added. “This is changing the dynamic of where a business spends its time.”

A managed security services provider (MSSP) can help translate those priorities into day-to-day operations, bringing dedicated expertise to monitoring, investigation and response.

Specialist value also lies in helping internal teams interpret what they are seeing, prioritise action and improve the effectiveness of existing investments. Clear responsibilities, escalation arrangements and regular reviews help ensure that external support becomes part of how the business manages risk.

For an MSSP relationship, this means connecting security operations to the customer’s wider program of change.

For Hunter, practical guidance needs to draw on developments beyond any individual organisation.

“We provide security operations for approximately 450 organisations of different sizes across Australia, so we see what’s changing in the market and what’s changing in government,” Hunter added.

“Based on those learnings, if we had one recommendation over the next 2-3 months, it would be for businesses to have a pragmatic conversation about modern security.”

That wider perspective can help leaders assess emerging challenges and decide which warrant action. The strongest provider relationships turn that knowledge into a shared plan, with progress measured through better visibility, timely remediation and stronger operational readiness.

As AI adoption expands, the priority is to build a security capability the organisation can sustain – and a partnership that helps it make informed decisions about what comes next.

This exclusive session is part of an Executive Insights Program – The Frontier Firm: An Australian Approach – designed to explore what it takes to build and lead a Frontier Firm in Australia. Through independent research, executive roundtables and industry analysis, this editorial series will outline how organisations are navigating this transition, the challenges they face and the opportunities ahead.