There is something rotten in Australian corporations relating to cyber security

As an Information Security / Cyber Security leader for 30+ years, I’ve had enough. In fact, as the saying goes, enough is enough. There are stories in this paper to remind us that real people are severely impacted by what is at stake. Here is the issue - Australia finds itself in the midst of an escalating cyber crisis.

The past few years have delivered a relentless series of breaches, each one more sobering than the last. From the theft of sensitive medical records at Medibank to the sprawling compromise of telecommunications giant Optus, and most recently, the April 2025 attacks against Australian Super and multiple superannuation funds - the trend is no longer deniable.

These are not isolated incidents. They represent the symptoms of systemic weaknesses embedded deep within Australian corporate culture and governance. The attackers have evolved, but more importantly, they have identified Australia as fertile ground for exploitation. In my role as CEO of Cyber Impact Consulting, I have seen firsthand how fragile the defences of many of our largest enterprises truly are.

This presentation is an evidence based, ground level examination of what is failing inside Australian boardrooms and IT systems alike. It is also a call to action. Using real world examples, expert insights, and recommendations drawn from both international best practice and our own hard-earned lessons, this paper provides a roadmap to rebuild trust and resilience in our corporate cyber postures.

The stakes are human. Every breach compromises not just data, but the trust of our customers, the confidence of our investors, and the security of our nation’s economy. The moment to act is now.

Root Causes of Australian Corporate Cyber Failures

One theme emerges with clarity: these are not just technical failures. They are organisational and cultural failures, rooted in persistent underinvestment and short-term thinking. Let’s examine the most critical causes.

1. Cybersecurity as a Cost Centre

Too often, cybersecurity is seen purely as an expense, not as a risk mitigant or trust enabler. Before its breach, Medibank reportedly allocated less than 2% of its IT budget to cybersecurity. This misperception leads to underinvestment in proactive defences, making organisations attractive targets.

2. Short Termism in Executive Incentives

Executive KPIs are typically tied to short term financial outcomes rather than long-term resilience. Growth and market share dominate boardroom discussions, pushing risk mitigation to the sidelines until it is too late. In the Optus case, rapid customer acquisition goals overshadowed basic cybersecurity hygiene.

3. Underestimation of Risk Exposure

Many boards still mistakenly believe they are unlikely targets. Prior to April 2025, Australian Super reportedly assessed their cyber risk as low likelihood. This gross underestimation of the threat landscape left them vulnerable to credential stuffing attacks.

4. Board Level Cyber Literacy Gaps

Lack of cyber fluency among non-executive directors. According to the Australian Institute of Company Directors, fewer than 30% of Australian board members consider themselves highly cyber literate. This inhibits meaningful challenge and oversight of management’s cyber risk handling.

cont... with other root causes.