KB [00:00:10]:
I recently attended SPHERE by Atmos to sit down with some of the presenters on the day for one on one interviews and to meet with people attending to find out what brought them there and what they learned from the day. Over the next few weeks we’ll be releasing these conversations to the public, providing rare insights into the state of cyber security and risk for Australia, New Zealand and on a more global scale. We’ll find out exactly what moving beyond just a responsive moment of crisis actually looks like. Stay tuned.

KB [00:00:45]:
Joining me now is Reece Corbett Wilkins, head of First Response Australia and is the Chief Strategy Officer at Atmos as well as I’m joined with Leah Pinto, Director Cyber Intelligence at CyberCX. Thank you both for joining and welcome.

Leah Pinto [00:01:00]:
Thank you. Thanks for having us.

Reece Corbett-Wilkins [00:01:01]:
Thanks kb.

KB [00:01:02]:
Okay, so we’re at the end of that SPHERE.

KB [00:01:05]:
You’re obviously on a hype. Today was amazing. A lot of good energy in the room that I noticed and I observed. But tell me, what were your key insights from across the day? Leah?

Leah Pinto [00:01:15]:
Me? There was a lot. It was really good vibes. I am absolutely exhausted, but also pretty pumped. Like it was a really cool vibe. Great speakers, great presenters, a lot of really heavy topics tackled, but the audience was huge. Right, how many people did you have?

Reece Corbett-Wilkins [00:01:32]:
1500.

Leah Pinto [00:01:33]:
1500 people. So for a cybersecurity conference, it was epic. The key themes across the day. God, there were many. I think for me the key themes that came out was a lot about collaboration that we all need to work together to tackle the issues. We had everyone from lawyers to tech to CISOs, we have media in the room and we’re all fighting the same fight, but we’re fighting it slightly differently and it’s almost like we’re speaking different languages in a way to get to the same end goal. So that was a really good insight for me. It gave me a lot of comfort in the industry.

Leah Pinto [00:02:07]:
We’re tackling some big problems, but it was really cool to see everyone fighting in the same objectives.

Reece Corbett-Wilkins [00:02:18]:
Rhys, heaps and heaps and heaps that we covered today. You’ve probably picked up that we set ourselves a very ambitious target which was to try and change the entire industry’s mindset, or what we were calling the center of gravity, from being fixated on the moment of crisis and instead much more focused on the resilience, the before, not after, boom. And we conceptually try to work out, okay, well how do we do that in one day? And to Leah’s point, a big part of it was getting the right speakers. And interestingly, when we Spoke to all the different people that you invite to these things. They saw the vision. They all just saw the vision. And they’re like, I want in on that. I want to be on stage on that day when our industry has that defining moment.

Reece Corbett-Wilkins [00:03:05]:
That’s the speakers, the audience members showed up with heaps of Energy. Okay, 1500 entities, sorry, 1500 guests, 800 different entities, 100 ASX listed small business representatives, everyone in between. So lucky at a really broad church. And I think that gave us that ability to kind of then reflect on what, if so much makes us different, what makes us the same? And we came back to this point of like, we’re all humans, which is ultimately the conclusion that we landed on as the kind of the call sign for what, what, what is going to drive that mindset at a national level. And then I think the last thing for me was, yeah, Leah, you kind of touched on it, which was there was some, like, big heavy conversations that we all kind of, at the end of it, just like, didn’t know what to say, just had to take a big breath. And I think that showed the enormity of the problem.

Leah Pinto [00:03:57]:
It’s like a gravity of our jobs.

Reece Corbett-Wilkins [00:03:59]:
Yeah. It’s like this elephant that we know we can’t eat in one. We don’t even know where to start eating it. Be frank. But I have hope. To your point, Leah, Like, I too agree. Like, I’ve hoped that when you have that convergence of people or with that same intent to change things over time or even in the short term, that’s where we’ll start to see success.

KB [00:04:20]:
So talk to me more about the vision. What do you think? So obviously you’ve done this year. What do you think? Sort of moving forward for the rest of 2026 and then into next year.

Leah Pinto [00:04:31]:
How are you going to top it next year?

Reece Corbett-Wilkins [00:04:33]:
I don’t know is the honest answer. I’m hoping it’ll be a. I hope it’ll be like a sitrep, like a report on progress, you know, how do

Leah Pinto [00:04:38]:
we go to get the audience members to be the presenters to see what did they do in the last 12 months to achieve our objectives?

Reece Corbett-Wilkins [00:04:46]:
As much as I love being on stage with you, Leah, it was so much fun. I was actually, to me, it was actually the highlight was being on stage with you. But yeah, next year I want to be in the audience and watch them do it.

Leah Pinto [00:04:54]:
You know, it was fun. And you know, cybersecurity conferences traditionally aren’t fun. I’m not a technical person and I generally fall asleep when it gets too techy. But the topics were just so interesting and engaging and I looked around the room and you often see people on their phones in these sort of conferences. Everyone was fully engaged and you could almost see those brain bubbles of people really thinking, that’s what I. When I say it was heavy, that’s what I mean. There was some big concepts tackled, some big issues and some big proposals on how do we move forward together as an industry. It was really cool to see those light bulb moments for people, whether they be people on stage or us when we were talking.

Leah Pinto [00:05:37]:
But the audience, it was awesome.

Reece Corbett-Wilkins [00:05:39]:
I particularly enjoyed. I mean they’re all great sessions and if I try to single out one, I’m just playing favorites.

Leah Pinto [00:05:46]:
You did at the start though.

Reece Corbett-Wilkins [00:05:47]:
I know I did, I did.

KB [00:05:49]:
What was that then?

Reece Corbett-Wilkins [00:05:50]:
Well, actually I wanted to. I’d love the data one because I’m a data nerd and I think that we’ve got a data problem which is if we don’t actually fundamentally know the size of the problem that we’re trying to fix and we can’t fix it. But I’m gonna, I’m gonna change my mind and I’m keen to hear what your favorite one was, actually. I’m gonna change my mind. There was a session and this could either have gone really well or not well at all. So it was a bit of a punt, but it was essentially, you have a journalist, you have a sizo, you have a director, and then you have a litigator walk into a bar, right. And try to get them to talk about their perspectives on life and hopefully start thinking that they’ll like complete opposite ends, but at the end of it realize they’re best friends. So I either thought it was going to end up in a fisticuff or them holding hands.

Reece Corbett-Wilkins [00:06:30]:
And I think we got pretty close

Leah Pinto [00:06:31]:
to the holding, close to both. It kept swinging.

Reece Corbett-Wilkins [00:06:33]:
Actually that is true. There were moments I was worried. But I think the point which you made, which is whether you’re a litigator funding class actions to hold companies accountable for wrongdoing, okay, Whether you are a sizo, who’s responsible for safeguarding the gate, whether you are a director who’s responsible for governance or indeed whether you’re a journalist who’s trying to report on public affairs, we all fundamentally agree that they all have the same intent and want to see our world be the same as an outcome. It’s just how they do it in their day to day trade and the conversations they have until point the language they speak is different and that’s what makes them feel like they’re different. But in fact they’re actually much more similar than they first thought.

Leah Pinto [00:07:14]:
So I’m gonna agree with that. And when we went through the agenda, you were so excited, like, this is gonna be such a great session. I looked at it, I was like, yeah, like it’s cool, but it’s not my jam. But that was my light bulb moment because a lot of the other topics, you know, I know a bit about, I’ve talked, talked to people about, and I speak to execs and boards all the time about this stuff, but I speak in my language. But listening to that was the moment where I went, oh, wow, like all of the aligned industries want the same

Reece Corbett-Wilkins [00:07:39]:
thing, which is just a safer world or just a more a clearer world that we operate in. Like, what are the rules of engagement? What happens to our data when we give it to a tech company in the us what happens when we click that thing?

Leah Pinto [00:07:50]:
It’s just what’s our social responsibility around people’s data and harm? And how do we report on that?

Reece Corbett-Wilkins [00:07:55]:
How do we educate our kids and the next generation about misuse of technology or technology harms when we ourselves don’t even understand the technology or the harms like this. So I think we kind of, this is my point about it came back to real human issues, which is like, we’re all human and we just want to be safe and we just want to be comfortable.

KB [00:08:11]:
So going back to the bar example, who was the most intense, the journo, the litigator?

Leah Pinto [00:08:15]:
I think they all had that moment. You’re saying from experience litigator?

Reece Corbett-Wilkins [00:08:20]:
I think he was the.

KB [00:08:21]:
Yeah, that’s because of your background, not the sizo.

Reece Corbett-Wilkins [00:08:25]:
So we had a fill in, which was John Moran because somebody couldn’t make it because of the Middle east and the flight delays. He was talking more on the perspective of speaking to sizers and speaking to directors. I think his perspective was really interesting because he was kind of independent and a little bit objective of everybody else and their own kind of personal views. I, I mean, look at Patrick Gray, right? Like that guy’s cyber royalty. To have him even here and saying anything was just a privilege. But he was incredibly insightful about so many different things. And in particular he was kind of talking about this, how do we make cyber sexy? Or how do we make certain really nuanced discreet issues such as this concept of the digital duty of care, which is what they’re talking about.

Leah Pinto [00:09:10]:
How do we gonna nerd Out. I am gonna lawyer.

Reece Corbett-Wilkins [00:09:12]:
I’m set myself up. How do we make that sexy? Because unfortunately, it doesn’t sell. And so how. We can’t make these, like, really complex topics mainstream unless we either simplify it or find a connection to the human beat, the human condition.

Leah Pinto [00:09:28]:
But I think Waleed Ali picked it up in the end when he was talking about his impression of the media, saying, I think media and journalists care about this stuff, but the industry isn’t set up for it to take the time to understand the technical nuances and what that actually means to then report on it. So I thought that was really how do we make this mainstream to understand that cybersecurity is important for everyone from the big end of town, critical infrastructure organizations, to the mums and dads that are trying to teach their kids not to use social media. Don’t send photos on apps that you don’t know who the owner of the app is or where the data is going. So that was, for me, quite interesting. And it really is that education journey.

Reece Corbett-Wilkins [00:10:07]:
I want to talk about our dynamic on the stage, the three Bus. We tried something new this year and I was told by a lot of people to say, hey, don’t do it. It’s too much risk. It’s the first year. It’s the. So having three people on stage as the, I guess the emcee. But also we weren’t really emceeing. I mean, that was part of which is up next.

Leah Pinto [00:10:23]:
And we were the voice of the audience.

Reece Corbett-Wilkins [00:10:25]:
What was the reason? Yeah, we’re the voice of the. Well, I tried to be. Yeah, it was fun. Like, I think just having, I mean, Waleed being there. Obviously it’s Waleed. He’s an outsider. He’s not a subject matter expert, but he could take it all in, then kind of like wrap it up and then give it back to us as a gift. And everyone was just like, completely like, ah, that’s a really interesting and unique perspective that helps someone understand some of these topics and connect them.

Reece Corbett-Wilkins [00:10:48]:
But I don’t know, Leah. I just had so much fun with you. Like us bouncing with each other, bringing our own personal lives, our professional lives to it. It was fun.

Leah Pinto [00:10:57]:
It was fun. I did go into the day thinking, how much can I heckle you on stage?

Reece Corbett-Wilkins [00:11:01]:
I was waiting for it. I was ready.

Leah Pinto [00:11:03]:
But we agreed on everything.

Reece Corbett-Wilkins [00:11:04]:
I know. Yeah. Well, something mostly.

KB [00:11:06]:
So I want to know, you said before Patrick Gray, the question was, how do you make the industry sexy? So what came out of that?

Leah Pinto [00:11:15]:
Oh, geez. What came out of that.

Reece Corbett-Wilkins [00:11:17]:
So I think, yeah, I mean, you made the point, right, which is it’s not that journalists don’t care, it’s just that they’ve got a job and they’ve got to find something that, you know, hits with the audience or hits with their producers requirements. But, you know, not talking up pkb, but, you know, that’s why what you do is so helpful and instrumental. And I think it’s how do we, how do we make. Probably the short answer is his kind of advice was how do we leverage the tech media that clearly does love this stuff, like really, really dial into the tech media and then try to somehow potentially aggregate that into mainstream. And I think if you can find that, then you find issues that are relevant to the people in that room will be relevant to everybody. So as an example, I talked a lot about today about like the whole dysfunction at the moment with the U.S. government and the AI companies. And you know, that’s something that we all, I can see you’re nodding like, like we all know that.

Reece Corbett-Wilkins [00:12:11]:
But if you go and speak to your next door neighbour, they’ll be like, what are you on about? Right? It’s how do you take that into the realm of public.

Leah Pinto [00:12:18]:
Waleed said something at the end of the day where he said it wasn’t a it something issue, it was a to say connected issue. When he summed up the issue of cyber and the issue that we’re battling, it was like a society issue, but he used really powerful words. Don’t know what that was, I can’t remember, but it was really powerful because having an outsider looking in going like, this is a real issue for everybody. We live and breathe this stuff and we will talk about it all the time. But I don’t know about you, but everyone that I speak to just glazes over when we talk about this stuff. You know, I can’t even get family members to change your passwords. So to have these kind of topics to be mainstream and have conversations at barbecues and at home and I think we shifted a couple of years ago when people impacted, when we had our awareness moments with Medibank, Latitude and Optus, but people were paying attention. But it’s, how do we take it to the next level to set up the next generation and protect Australia’s interests.

Reece Corbett-Wilkins [00:13:13]:
And I think the analogy which I loved at the end was it’s in the air and we’re all breathing it, we just don’t kind of realize it. And almost had this moment of like,

Leah Pinto [00:13:20]:
that’s what I was trying to think,

Reece Corbett-Wilkins [00:13:20]:
I must have this moment of like, it’s asbestos in the air. It’s like we’re all actually like suffering from asbestosis, but don’t realize because it’s this.

KB [00:13:26]:
Yeah.

Reece Corbett-Wilkins [00:13:26]:
And that’s, I think, his point, which is if we can somehow connect it to the human condition, make it relevant, then you’ll get that impact.

Leah Pinto [00:13:33]:
But to us, it is. It’s blatantly connected to the human condition, whether it be the harm from sensitive data or the operational disruption of a hospital, for example. To us, it is. But that’s not everybody else’s perspective that doesn’t live in this industry.

Reece Corbett-Wilkins [00:13:47]:
I’m going to come back to in a moment about something that also we picked up about, which is like, how do you connect the dots between. It’s not relying on the government or not relying on business. It’s everybody’s mission. But before I do, I’m going to come up to your point, which is, I can’t get my friends to hear me at a barbecue and take care of what I do. Right. I brought my wife today, she’s a teacher, has nothing to do with cyber, but I brought her today mainly for support, you know, cheerleader squad. But, like, I think there’s. We need to find those opportunities, genuinely, we need to find those opportunities of bringing kind of newcomers in to these situations.

Reece Corbett-Wilkins [00:14:14]:
I don’t know, maybe you’re.

Leah Pinto [00:14:16]:
I said to you the other. I said to you earlier. So I did some Channel nine media earlier this week and I got my hair done for today, obviously, and my friend is my hairdresser, and she said, oh, my God, I watched you on the news. I had no idea what you were saying. I didn’t understand it. All I took away was, I need to change my password. And I was like, yes, that’s okay. Like, sometimes I don’t know about you, but I talk to a lot of people about this stuff and sometimes am I really making a difference when I’m saying the same things over and over again? Then you have those sort of moments where you go, yes, I got through in a way that matters to you.

Leah Pinto [00:14:48]:
And I think from the faces of the audience and the response from the audience, particularly when we were walking around the vendor area after. I think there was a lot of those moments for people even within this industry, which is really cool and impactful for the rest of the community because, like, you challenged everyone to take it back and have those conversations with people that aren’t here today. So I think it’s going to have that ripple effect. So next year has to be better. Obviously you have to top it, but I’m really looking forward to seeing that ripple effect of change.

Reece Corbett-Wilkins [00:15:16]:
Yeah, same, same. And I didn’t want this just to be a conference of good chats. Like we really motivated.

Leah Pinto [00:15:21]:
Lots of good chats.

Reece Corbett-Wilkins [00:15:22]:
There are a lot of, there are great chats. We really motivated people to take action. And I know that that’s a conference theme and what are the five takeaways? And you know, that’s just how we con ends. But like today we really put a stake in the ground and said These are the 10 things that if we can do this as an industry next year, we will move forward years. So we did actually put a lot on the table. And the other takeaway, sorry you mentioned before about it’s everybody’s business kind of thing in terms of cybersecurity, what I found a couple of the speakers, like Chris Krebs in particular, made it so painstakingly obvious, is of course government has an incredibly important role to manage cybersecurity for our nation, right? They have access information and intel and connections and systems and servers and that only they have access to, right? So there is a absolutely a place to play for them. But what my mindset set shift was Chris Krebs being ex scissor, was saying, actually you don’t realize how much the government needs you, needs the business community to play their part, needs organizations to report to the ACSC if they have an incident so that they can get information that they don’t have access to match it against what they do have and start to understand patterns in the noise and all the rest of it. And I thought that was actually interesting because I think in Australia we generally have a pretty good team Australia approach when it comes to like reporting to government, for example.

Reece Corbett-Wilkins [00:16:46]:
But there’s definitely still underreporting, there’s definitely still pockets, there’s definitely. So I think that for me was a bit of a takeaway was we actually probably do have more power and responsibility and opportunity to make a difference as organizations than we think.

KB [00:16:59]:
And you know what’s interesting because I, I met a lot of people that I interviewed today, like doing two or three in a session. So there was probably like 20 plus. And I think the main undertone was how do we break the barriers with working with government, getting away from like, oh mum and dad, you’re the police. Because historically and traditionally people would fear. I still kind of do, to be honest, but I think I’m seeing that ripple through now. That’s like, okay, we’re going to have a conversation, we’re going to work with you. And I think that that really stood out from a media perspective for me,

Leah Pinto [00:17:30]:
the evolution of the industry. So I started in government and I started in cyber in government and then moved to the private sector. But when I started in government cyber, it was a very different operating environment. And it was. We didn’t have people wanting to talk to us, and we really had to work on that trust and relationship building. And I think that comes to. One of My other key themes is around trust. But I think we’re at a point where not only does the government understand that they need those partnerships, they need the private sector, but the perspectives the private sector have.

Leah Pinto [00:17:59]:
I know you do, and we do. We work on incidents. We get a lot of insights and intelligence that we can share to help the rest of the community, regardless of what sector you’re in. I just want to pick up on one thing and you sort of touched on, which is. My other main takeaway is around context. I am an intelligence professional through and through, so I will talk any chance I can get around the value of information intelligence sharing. But I think what came out for me today, context, but not the static context, where the goalposts keep changing. And particularly when Mike Rogers was.

Leah Pinto [00:18:29]:
That panel that was on was around the geopolitical context shifting so dramatically. And we can talk about that, and we have been talking about it for the last 12, 18 months, four years, a couple of weeks ago, since Russia Ukraine broke out. But we can really conceptualise that the goalposts change, the context that we work within changes. And not only in our room, but in the engine rooms. When we were, They would talk about cybercrime and the evolution of a hacker. That context is changing the ecosystem, whether it be on the digital technology, the regulatory landscape was touched on. See why I say it was very heavy. I feel like we tackled so much, but a lot of that comes back to understanding the context are you operating within and continually reviewing that.

KB [00:19:10]:
Okay, so the universal theme was the question, what are you doing in 2026?

Reece Corbett-Wilkins [00:19:17]:
How long have I got? How long have I got?

KB [00:19:19]:
So what’s that sort of like for you, or what came up when you’re asking people in the audience and stuff like that? I know it’s, you know, people can share that with you, but was there anything that stood out for you, perhaps?

Reece Corbett-Wilkins [00:19:28]:
Yeah, I might. I’m going to try and keep this brief because he’s probably got a podcast episode in every one of these Points. The first wish on my wish list. Okay, the first is can we get alignment on the data? So when I say small business, I mean $10 million less of revenue in my view. But that’s very different to everybody else. So when someone says 65% of small businesses got impacted by ransomware, are we even talking about the same group of businesses? We don’t have the same definition of small business. Then we’re all applying different things to that. So data second point is connectedness.

Reece Corbett-Wilkins [00:20:00]:
And this comes back to the power of leveraging each other’s strengths and ability, their capabilities. That’s that scaling point. And we’ve realized now that if you could wrap, if you got all the cyber people in a room and got them to work together, you’d have a, you’d have massive scale. But then add to that the cyber lawyers and then add to that the cyber insurers and then add to that the incident response industry.

Leah Pinto [00:20:20]:
Very loud, be a very loud room.

Reece Corbett-Wilkins [00:20:23]:
No. 1, everyone would talk way too much. But imagine if you brought them all together, you got these like unit, like collision of power forces. And anyway, my point on that was how do you harness the ecosystem? The third point is cyber insurance itself. We’ve openly put submissions online as part of Horizon 2 to mandate cyber insurance for small businesses. Now, I don’t think it’s going to happen. It’s too hard to push through quickly. There’s upsides, downsides, considerations, issues.

Reece Corbett-Wilkins [00:20:47]:
But my fundamental starting point on it is small businesses shouldn’t have the choice to be able to buy cyber insurance. In the same way they need workers health comp in the same way they need other things to people because they just can’t afford protect themselves or respond to cyber incidents. And that burden shouldn’t be put on individuals whose data is breached. Sure, it’s that simple. Now, not everyone agrees with me, that’s fine, read my submissions, you can have a chat about it. The fourth point will not be doing that. It’s a good submission, I assure you, if I say so myself. My fourth point, and this is probably the biggest thing that I took away, was we need to actually change our entire fundamental assumptions around how we view this issue.

Reece Corbett-Wilkins [00:21:25]:
So the thing that I loved about today, the thing that all kind of all the topics talked about was today at SPHERE, we gave everybody permission to think really big, to think really drastically, to like plan out what worst case scenario is and work backwards from that position. Because I don’t think as a business sector we’ve actually given ourselves permission to dream, permission to Fear permission to use context. And the context that we’re talking about, even just this week has fundamentally changed that of last week. So I think that that needs to happen. And then lastly.

Leah Pinto [00:21:57]:
Sorry, sorry. I was going to say it’s not that you gave permission as well, but you actually gave space for it. So I think that’s underplaying it by saying we gave people permission to do that because you created the space and the markers for people to be able to direct their thinking.

Reece Corbett-Wilkins [00:22:10]:
Yeah. And also said, this year is about creating space for you to do it, but next year it’s probably going. It’s going to ramp up. Like, we don’t see change. It’s going to be more of a you need to do not like you should and can do. And then look, lastly, the point is, just like we kind of said, are there any buttons that we can push or levers that we can pull to kind of like fix the situation? And we kind of came back to this point of the role of the media. I think the media can do more. I know we just talked about it earlier, so I don’t want to rehash it, but we have allies that aren’t cybersecurity people that can help us with our mission.

Reece Corbett-Wilkins [00:22:42]:
One example is the media. We just need to tap into that. We need to find those opportunities if we’re going to scale. What’s the loudest microphone? What’s the loudest. Where’s the. Where’s the marketplace? Where’s the soapbox I can stand on? Where’s the opportunity to get these messages clearly out to the people that need to hear it? That’s my big thing for hopefully between now and next year.

Leah Pinto [00:23:05]:
Wow.

KB [00:23:06]:
I think. No, I was just thinking, because I was talking to Stef Luhrs before and she’s like, you did the podcast with the former CISO of Medibank, and one of the things that he spoke about was the dissemination and mis disinformation from mainstream media people. But I was like, well, how can they understand these concepts? And they’re going to write stories quickly. So I do understand why there is that gap from that perspective. I mean, if you said, oh, go and report on like mining instance, I have no idea. So I think that it’s, how do we close that gap? Because then it does engender fear and distrust with within just everyday people. How do you solve that problem? I’m still not sure, but I think that’s what you guys are sort of talking about here today.

Leah Pinto [00:23:48]:
I don’t have an answer how to solve it. But I think there is an approach and it has to be bottom up and top down. So it’s teaching everyday people. If it’s the barbecue conversation, I don’t know what you’re like with your kids, but my poor son, like he was using an app that had vulnerabilities and I was like, have you read the Privacy policy? My 10 year old laughs at me. He’s 10 and my whole family laughs at me. But then the next time he comes back and there’s all these new apps floating around now with the social media ban, he’s like, mum, there’s this new app. I said, mate, we need to have a conversation. He’s no, no, mum.

Leah Pinto [00:24:18]:
I researched it and I looked at the privacy policy and I’m like, that is a moment that is a win. So when I say top, bottom up, that’s the kind of conversations. But then there needs to be that high level and you know, as a government we’ve got a lot of high level views. Perspectives like is on the agenda and there are a lot of neighbouring nations where it’s not not on the agenda as much. So it’s on the agenda there. But how do we bring that together to reach an entire population?

KB [00:24:42]:
Got it. And so couple of questions for you both. For those who aren’t unable to join SPHERE today, what are you sort of what’s going to be coming down the pipe next year? I know you said it’s going to be bigger and better and you missed out all the stuff going to be circus performers and everything, but what can people expect for next year at a high level?

Reece Corbett-Wilkins [00:25:04]:
What, and you’re committed on it now? What our commitment is between now and next year is we’ve done a podcast with an awesome podcaster. Her name’s kb. You should meet her sometime because we want to give assets that capture the moments back to the community.

Leah Pinto [00:25:17]:
Yeah, I liked that. That was really cool when you said that. I know you were doing that.

Reece Corbett-Wilkins [00:25:22]:
So I hope that people actually make use of this podcast and actually take it back to their organization, train their staff, get water approval for budget, etc. So that’s the first thing. Let’s keep momentum.

KB [00:25:31]:
Right, got it.

Reece Corbett-Wilkins [00:25:32]:
I and our team, there’s a big team behind us, we start our planning in about July. We kind of watch the current affairs of the world between July and October and start to get a bit of a feel for what would be relevant in March. There is a huge amount of guesswork and you kind of hope it all just lands. So I think the short Answer is context.

Leah Pinto [00:25:51]:
Context, Right.

Reece Corbett-Wilkins [00:25:52]:
I would love to hear feedback from people that were here today. What worked well, what didn’t work well. And also like in your conversations that you have in the next three months with businesses, where are you getting stuck? Because I have a feeling that next year is going to be like a bit of a sit rep, as I said, of how, what, what do we say that we did last year? What did we agree to do as an industry? Where, where are we up to and where we’re struggling? And maybe, maybe this just becomes like the platform for the next five years. And she’s got continually pushing, pushing us forward under this.

Leah Pinto [00:26:17]:
It’s like accountability.

Reece Corbett-Wilkins [00:26:18]:
Yeah.

Leah Pinto [00:26:18]:
It’s creating accountability to the industry and attendees to do what they say they’re going to do, do what they’ve been challenged to do.

Reece Corbett-Wilkins [00:26:23]:
And I think everyone today kind of did that. Like 3, 2, 1, hut. Yeah. This moment of like everyone agreed that we’re all on the same path, but I think we do need to find, we found clarity on the issue. We need to find clarity in the solution. I think that’s missing.

Leah Pinto [00:26:33]:
Yeah, yeah.

Reece Corbett-Wilkins [00:26:34]:
What would you like to see next year if you could do this all over again?

Leah Pinto [00:26:38]:
I think it comes back to when you say, you know, you’re watching the environment and the context. I think a lot can change in that July to September. We’re in a very unpredictable state, whether it be geopolitically or with the rise of AI, that I think it could, we could say something now and in six months time there could be a major incident, there could be major tech, technological development or something geopolitically could shift significantly. That could throw the plan out the window.

Reece Corbett-Wilkins [00:27:04]:
But I think, and I almost did this week, we almost lost like 10 speakers.

Leah Pinto [00:27:07]:
I think for me it would be like, see the next step of preparedness. You know, you challenge people about what are you doing to improve cyber resiliency in your organisation. I’d like to see the accountability of that. I’d like to see the stories on how that has been achieved. Achieved and the success stories. I mean, I don’t know about you, but I’m often doom and gloom when I talk these sort of things and I really try to create it. Yeah, but we’ve got this team like, yay, but we did that. So what’s next? Where can we sort of measure success and what that looks like?

Reece Corbett-Wilkins [00:27:36]:
I don’t know that we’ll be able to pull off a two day conference because there’s pros and cons. I think a one day is just like bite size and punchy and everyone loves it and then goes home and as a shower from all the heaviness. I think we need to work out how to get this to, like, other jurisdictions, like New Zealand, for example. We both do a lot of work in New Zealand. You were there last week. They are, you know, a few years behind us in terms of their cyber maturity generally. And, like, they love Australia in the sense that they can learn from, you know, where are you a little bit ahead and where’s our thinking a little bit further ahead and what can they do to rapidly implement that so that they can climb up quickly? I’d love to see how do we make the most of this in New Zealand? And then, like you say context, like they’ve got issues that are specific to them that aren’t specific to us. So I can’t commit to another conference right now, but it’s our intent to do this every year, so I hope that we can and we look forward to doing it again next year with everybody.

KB [00:28:27]:
And really quickly, final thoughts. Leah?

Leah Pinto [00:28:29]:
I need a wine.

Reece Corbett-Wilkins [00:28:33]:
And Reece, Chris said, I’m going to give you all something to drink about today. So listen up. And it’s a fair shout, which is we just tackled a huge amount. I mean, we’re both exhausted. We had a great day. I just hope everybody enjoyed it. And Leah, as I say, like, that was fun, man. I hope to do something cool with you again like that.

Leah Pinto [00:28:53]:
So, yeah, it’s good fun. Thanks for having me.

KB [00:28:55]:
All right, I think it’s time to get the wine. Sash beer.

Reece Corbett-Wilkins [00:28:58]:
Thanks. Kb.

KB [00:28:59]:
Thank you.

Leah Pinto [00:28:59]:
Thank you.

KB [00:29:03]:
Joining me now in person is Anthony Cook, partner at Atmos New Zealand, and James Blakely, the head of Government Relations at Atmos. And. And of course, Michael Boyd, Director at ASD. In this session, we are discussing why the government can be your friend and a facilitator, not just the fun police. So, gentlemen, thanks for joining me and welcome.

James Blakely [00:29:21]:
Hello. Thanks for having us.

KB [00:29:24]:
Ok, so in a large breach, how can the government assist organisations with recovery? And that’s sort of been the undertone a lot today, depending on who we’ve been interviewing. But who would like to answer that first?

Michael Boyd [00:29:35]:
Yeah, yeah, very happy to answer this one. So I guess the government can help everybody to recover from an incident through either providing, like, great tailored advice and assistance to fill in some gaps that they might have as well as. So we have our National Office of Cyber Security, who can help coordinate across all the government for when there’s responsibilities there that you might need to achieve and we’ve found that engagement with a lot of the arms of government, not just the regulatory arm, parts of government that do want to help you recover from these incidents has shown great benefits. Quicker times to recovery for people and that quick exchange of information with those, those entities as well has actually helped entities recover really fast.

James Blakely [00:30:24]:
I think we’ve had a lot to do with the NOCs and with ASD as well. And I think like Australia’s potentially leading the rest of the world in that coordination role that they provide. It’s, you know, it’s incredibly noisy when you’re working through an incident without having, you know, multiple arms of government coming in. And for them the most important question is one that they want to answer straight away. When you’ve got, you know, 50, 60, 70, 80 of those questions coming in, it just, you know, makes a lot of noise for the response. And so with the Department of Home affairs, with a national office, cyber Security, by coming in and buffering those agencies that are needing information, but consolidating that and bringing that down through one pipeline to the business to consider and then provide advice to is a massive help. And then of course with the ASD as well, it’s information sharing is probably one of the most powerful pieces to respond but then also prevent. And there’s an amount of information that can be used for both parties as well.

James Blakely [00:31:28]:
So we see great value with like Australia leading the rest of the world with that coordination support.

KB [00:31:35]:
Yeah.

Anthony Cooke [00:31:35]:
How do you go that from a New Zealand perspective? We do not have that coordination perspective and it really shows, you know, also being qualified in Australia and New Zealand and working in New Zealand, I can see that distinction in real time and how that works. What the government is really good at, including in New Zealand is providing intelligence and some sort of, you do feel that collaboration, unfortunately it’s a little bit of a one way street. When I look at New Zealand, when an organisation shares intelligence, there’s no protections in relation to that information being used against that organisation. Which as a lawyer makes it tricky. Right. Because I can’t give them any comfort around assurance or confidentiality, which hopefully you would expect. But without that sort of framework in place, it does limit the ability to collaborate. So when I see what’s happening in Australia and I do think it is leading the charge and I’m sure it’ll be adopted in New Zealand at some point if those discussions are not already happening.

James Blakely [00:32:29]:
Yeah, so that’s the limited use disclosure obligations. So that’s legislated restrictions on what information can be used and how by government. And so it’s a great step forward in a more mature model than relying on the traffic light protocol, which is voluntary. So that helps us have a greater degree of confidence that the information that’s being provided is going to be used for the right purpose, that that kind of minimises the risk on the company when it provides it and it just facilitates the information sharing.

Anthony Cooke [00:33:04]:
And to bring in an example, to light, I was working for a Trans Tasman business, was advising the New Zealand board. Without those frameworks in place, we did not tell the government anything about the ransomware event or any of the IOCs, but the Australian arm of the business, they reported the ransom, told them the amount, gave them all the details and also the IOCs, because they had that comfort in place. And that was just a sharp contrast. And I think part of that comes from different cultures. So looking at how the Australia and New Zealand contrast a little bit, Australia doesn’t have the same high trust in government, traditionally speaking, when I compare that to New Zealand. So it might have been that these frameworks have been developed to promote collaboration and it works. Whereas in New Zealand, we traditionally have a high trust in government. So the government has been able to rely on, to some extent, people voluntarily sharing information.

Anthony Cooke [00:33:52]:
But I think with the market maturing and the compensation culture of cyber risks coming to life, it’s becoming a little increasingly problematic, especially for large organisations.

Michael Boyd [00:34:04]:
I think we’ve actually got a really good example of that trust that’s built from around limited use. We’ve had an incident reported to us originally, they were very standoffish in regards to what was happening and the type of information they were sharing. We sat down and explained what limited use would be, protections that provide what the information could be used for. And first we did it in the legal jargon terms and then we actually explained it in probably layman terms that they actually understood. And after, after we did that, they. You could actually physically see them, like, relieved that they were talking to someone who was going to protect their information, not use it for punitive measures. And they actually shared a lot more than we thought they would. And it was great because we were then able to actually say, oh, from that, what you shared, actually, this is your issue.

Michael Boyd [00:34:49]:
This is where you need to. What you need to do. And they actually recovered. So it was really great experience.

KB [00:34:56]:
So then, Michael, on that note, what I’m hearing a lot from people I’ve interviewed today is there’s a lot of those barriers being broken with industry, government. Like, historically, people were Afraid maybe to your earlier point, it’s not quite there yet. Are you seeing that change then, over time, with people being a lot more like collaborative? Whereas before it felt like it did feel like the police. And I think people were maybe worried about that and apprehensive about coming forward, perhaps about being slapped on the wrist.

Michael Boyd [00:35:23]:
Yeah, I think, like, I guess historically we’ve always seen government as the fun police, but I think more and more now,

Michael Boyd [00:35:30]:
everyone’s getting out there, everybody, like cyber security is becoming norm. Right. Breaches are becoming a norm nowadays, you see even in the news every other week, every other day. And I think a lot of our organizations, ASD as well as the NOCs, are getting out there and communicating that we’re here to help, we want to help you, we want to protect your information, etc, like that. So I think, yes, it’s slowly starting to turn around, people being more collaborative, friendly and overall, I think it’s good. And a lot of themes today, a lot of the panels talked about that as well.

KB [00:36:05]:
Ok, so then, moving on, in terms of prevention, are governments globally and perhaps a focus on Australia and New Zealand doing enough to provide the required support? Maybe, Anthony, you can start, I think,

Anthony Cooke [00:36:20]:
maybe more with the New Zealand focus, but it also applies to Australia, is our economy is highly dependent on offshore services. Whether it’s cloud services, there are limited local options to go with. I think more leadership in how these local businesses are managing those contractual arrangements and those protections and understanding how this data is being looked after or whatever services security controls are in place to protect the viability of those systems needs to occur. At the moment, it’s a little bit. Well, if my provider had an incident and they had a cyber breach, that’s just annoying for me. Whereas rather, we need to shift the conversation where they need to take ownership of using those suppliers in the first place. And of course, it’s a race to a bottom without a legislative framework, it’s a race to the bottom of pricing because you’re just going to go for the quickest option, least security controls, et cetera. Whereas if there are minimum standards, we’d start to see some better decision making about which suppliers should fall in a supply chain of an organisation.

KB [00:37:26]:
And then perhaps. What about coming out of Australia?

James Blakely [00:37:32]:
I think government’s doing quite well. There’s obviously always an opportunity for improvement. Government has the same challenges as what businesses do.

Michael Boyd [00:37:41]:
Right.

James Blakely [00:37:42]:
There’s only so much money and there’s competing parts, priorities for that. Here in Australia, They’ve got Horizon 2 coming out, which is starting to look at further down the supply chain and those smaller businesses and that is going to have a tangible uplift and bring along the people in the supply chain. I think it’s not just government though, it’s really difficult. We’re also seeing challenges and topical but we’ve got anthropic and we’ve got the US government and it kind of comes into the government used to be the 600 pound gorilla in the room and they got what they wanted. They’re not anymore and we’re seeing that on a large scale now in the last couple of weeks. But historically as well, to Anthony’s point, we rely on these global SaaS providers and the government isn’t able just to muscle in the terms that it thinks is relevant. So I think there’s a piece of business to do as well and to like you know, commit to the, to the social ledger and bring their actions up in line with what’s expected. And then lastly as well then it’s great if you know government is the judge and the jury and the executioner, they write the legislation and set the standards as they can and then businesses come to the party.

James Blakely [00:38:56]:
Well we need individuals as well also to think about well I’m the last piece of that pie. I’m going to be know more responsible, I’m going to better educate myself about these risks and then I’m going to deliver on that. So all three pieces that pie come

Michael Boyd [00:39:11]:
together with your like Horizon 2 coming out soon. We do get a lot of feedback on that in regards to the supply chains, small businesses, et cetera that we should be focusing on too. Like they’re the, the underbelly of how a lot of our organizations work here for what government’s currently doing. We are like, like ASD cross sectoral exercises to actually get people to exercise their preparedness for a catastrophic incident or something like that. The docs also run their sectorial exercises to help people there. We’re continually pushing out our advice to areas so that they understand the risks that might be out there, what they need to do as well. So especially with supply chains, third parties like ASDL doing some campaigns to talk about that what entities small businesses can do as well. So I think yeah Australia’s government’s doing a good amount in this space.

Michael Boyd [00:40:11]:
There is more that will come out as part of Horizon 2. But I think it’s also the Australia as a whole needs to kind of get behind this and realise that cyber incidents will occur and we need to try and prepare ourselves as much as Possible, Yeah.

James Blakely [00:40:26]:
I think, like coming out with last week as well, with the directive under the PSPF is actually really helpful. Right?

James Blakely [00:40:34]:
Like, it sends a clear message that you need to patch this or address this incident. Right. So even if you’re not, you know, sitting in under pspf, you’re going to take note of that.

James Blakely [00:40:45]:
And because the risk is real, if it’s big enough risk for those entities, it’s big enough for us, and then that’s going to affect the change. So I think that was fantastic coming up, that directive.

KB [00:40:57]:
And then will we start to see more moving of the needle? Because I know over the years, just in my experience of working in the field historically, it’s like, oh, we’re going to do all these things and we just haven’t seen that movement. But even in recent times, I am seeing people are getting closer to that outcome. Does anyone have any commentary on that?

James Blakely [00:41:13]:
We’re a little bit to add. I think there is actually good collaboration between government and industry. And it’s about. You’re never going to be able to stop them. Right. It’s just going to. They’re just going to keep changing their trade craft to the tax surface increases. So how about you just remove the objective utility of the information or the impact.

James Blakely [00:41:32]:
So if we can move off all this hoarding of personal information, which, you know, has been legislated for organizations that come in under amlctf, so we can update that legislation, remove that, if we can, then onboard, you know, private enterprise digital identity solutions and rely on that, that means we’re reducing the amount of PI that we’re collecting. But organizations are working with ASD and other readiness entities to kind of improve their response fitness. So if they do have an incident, they’ve got, you know, a plan in place, they know what they need to do. They have viable backups, they know that they’re viable backups. They, you know, restore the backups before then. That’s going to get better as well. Right. So I think there is movement.

James Blakely [00:42:16]:
Definitely the needle’s shifting. Right,

James Blakely [00:42:18]:
We’re not going to get there straight away. Might take another couple of years until we offload all this PI that we don’t need. We move away from relying on that. And then organizations, you know, it’s just the norm that you do, you know, once a year, twice, three times a year. An incident response plan or simulation? I think.

Michael Boyd [00:42:39]:
Yes. I’m just trying to think what to actually add that’s actually different to what you said.

James Blakely [00:42:44]:
Like information sharing.

Michael Boyd [00:42:46]:
Yeah. Oh, yeah. True information sharing. Passage of Information sharing is like critical for anybody to respond. I think in my session I talked about how it takes a bit like it’s not individuals who respond, it’s a village to respond to incidents and the passage of information quickly. Collaboration quickly is core to making that happen, both with government so that we can fill some gaps that you might have. Hopefully fill some gaps that you might have in regards to your investigation and recovery process, but also again, back to like your supply chains and the people who need to you or interdependencies that you have pass that information out to them. So one, they’re sure that you’re actually doing something about it as well.

Michael Boyd [00:43:33]:
And two, yeah, they know you’re doing something, they know you care about them and you’re doing everything you can to recover.

Anthony Cooke [00:43:41]:
Look at you two guys glow about all these great initiatives that are coming out in New Zealand. I do feel we lack some of these frameworks. I don’t think the intelligence is there or not even understanding that these things should be done. It’s just with the smaller economy, every single standard you put on business just makes it more and more challenging for them and it is just hard. What I would love to see is just those minimum standards start to rise and we bring the minimum, the low tide up a little bit. Because as a lawyer on one hand, all these frameworks and standards we have in place, we can just dance around them. They’re super easy. But then from an idealistic, taking a step back, what I actually want to see is some great initiative.

Anthony Cooke [00:44:22]:
But then I appreciate, you know, the powers that be do have a bit of a balancing exercise there as well.

KB [00:44:28]:
So I’m going to move on now to if you look at things like gdpr, CCPA or California Consumer Privacy act, ndb, notifiable data breach scheme and so on, where is the government sort of falling short or perhaps where can they really double down on those steps to support businesses?

Anthony Cooke [00:44:44]:
If we’re just talking about those core privacy legislations, looking at Australia, the exceptions there, you know, the Small Business Extension and things like that is just so off market and so off brand compared to the rest of the world and compared to Australia’s trading partners, it’s also an old clunky piece of legislation. You’ve got credit reporting and things like that in there. Like there are things that should be revised and from an outsider’s perspective, I’ve heard a lot of talk about the reforms, but they just come across clunky. No set timeframes and issues like that. So I guess that’s from a pure legislative viewpoint,

James Blakely [00:45:20]:
I think further to that, to the clunkiness and, and the outdatedness there. Like the, the world’s changed. Yeah. And, and even like the tax file numbers. Right. Like, I think it needs to be a little bit more nimble. Maybe some of these bits come into the regs instead of the legislation itself and those regs are updated more frequently and so as systems change, as the threats change, etc. That they can be updated to be more timely.

James Blakely [00:45:46]:
Right. Like the NDP coming in in 2018 or 19 when we’re 20, 26 now. And you know, we’ve had one reform to the act and almost tranche one and so in a small number of the total recommendations that was accepted by the government for that Act. So that says to me, I think streamline the legislation piece, move the variables into the regulations so they can be changed and then like get the guidance down pat for small businesses, like we love our lawyers but like that you don’t have the money to have a general counsel, a siso, cio, everything else. And so if the exemptions are going to go, we’re going to have to support those agencies, those smaller businesses to comply with the Act. But then if they can’t afford the response, how can they work through it to be compliant?

KB [00:46:36]:
So before moving to you, Michael, just staying with you for a moment, James. Industry always tells me that it’s like very convoluted, it’s like big document, how do I read it, how do I get around it, where do I start? And to your point before, like SME. So SMBs don’t have capital to be able to do this. So what do you. Majority of our market in Australia is small to medium sized businesses. So what’s, what’s going to happen there?

James Blakely [00:46:57]:
What, what’s going to happen? What I’d like to happen and it’d be amazing if we could have a green slip, pink slip for businesses like what we do for motor vehicles here in Australia. I wouldn’t say it goes on, on every business but if, if you’re operating where you’re in critical infrastructure or the supply chain that has a risk or you deal with a lot of personal information, then you know you have to have insurance and to get insurance you need to get pink slip. So you need to tick off that you’ve got pink, know some controls, whether that’s essentially whatever, whatever that looks like. And to Anthony’s earlier point about, you know, all boats rise with the tide.

KB [00:47:37]:
Yeah.

James Blakely [00:47:37]:
Like then, then that kind of brings it up the Standards of the businesses that are operating gives them that kind of comfort. If it does go wrong, then they’ve got the insurance to kind of come in and bring those experts to help respond to the incident. So I mean that’s what I’d love to see.

Anthony Cooke [00:47:53]:
Yeah. And I think, you know, pointing out the gdpr, that’s criticised a lot for being a code very prescriptive on what organisations need to do. So if you have a supplier you have to have these contractual arrangements in place. Now that can be quite annoying for a large business that being told what to do essentially. But for a small business that doesn’t have a lawyer, that’s brilliant. All of a sudden you’re no longer negotiating these things. This has to be done and that’s the way it is. And so there’s a balance there between having these principles based regime where lawyers have a field day because you can interpret things and balanced against where you’re actually told what to do, what that standard is and sets the expectations and you can go from there and negotiate other aspects of the contract.

KB [00:48:37]:
Michael, what are your sentiments?

Michael Boyd [00:48:39]:
I actually think a lot of the points you’ve raised are really good and like the small business things and setting the minimum standards. So like I guess asd we have like the essential eight that’s out there and there is this feedback. It’s like it actually costs, does cost a lot of money to actually get to that top level maturity there. So like the feedback we’re here and I think some of the work that’s going on is how can we actually tailor this for some of those smaller businesses? Because like you said Australia, we have a lot of, lot of them in that here. So how can we actually tailor it so it’s actually easy for them to implement to help them protect themselves from

Anthony Cooke [00:49:15]:
these incidents and also just mean, you know, look at these legislations thinking about, you know, things in real world today, something that really stands out in the New Zealand regime is you can apologize now when you do a Privacy act notification, you can say I apologize for this incident without prejudicing yourself or creating a claim. And that’s just, you know, that’s so sweet. That’s so Kiwi. Right. But it just creates a bit of a soft point and touches on the reality. Look, we are sorry we did this and we can be upfront without, you know, in other regimes you just have to dance around it and say we regress and things like that. And just understanding the world that we now operate in, these things happen and let’s you know, change the tone of the language that we’re using.

KB [00:49:53]:
And lastly, maybe one quick key takeaway from all of you today before we wrap up. So maybe Michael will start with you.

Michael Boyd [00:49:59]:
One quick key takeaway. Probably collaboration and open collaboration, like quick sharing amongst not just US government, but everybody, again, takes a village to respond to something.

James Blakely [00:50:15]:
I’d say kind of looking further afield. It’s good. Like we’re here in Australia, 12,000 or 17,000 kilometers away from others, and we feel like we’re a little island because we are a big island and isolated. But the harms that are flowing, flowing from some of the events overseas are going to come and land on us. And so we need to keep abreast of that. And then for boards in particular, note those risks and how they can mitigate them. They don’t need to go too deep down, but just being realistic about there are some risks, how do we measure them and how do we mitigate those?

Anthony Cooke [00:50:52]:
A key takeaway for me is in Australia. I think you should be really proud of the initiatives that are being made. Not every. Everything’s perfect, of course, but you’re moving in the right direction. And I just can’t wait for that to translate into New Zealand, because we watch and observe and we don’t have to do it twice. We can just see how you guys do it and copy paste.

KB [00:51:08]:
Gentlemen, thank you so much.

James Blakely [00:51:09]:
Thank you.

KB [00:51:15]:
And there you have it. This is KB on the go. Stay tuned for more.