Australia’s top cyber leaders have said that cyberattacks are no longer hypothetical, isolated events targeting only big corporations, they are now a daily threat to every Australian, every business and every piece of critical infrastructure that is connected to the internet.
Australia’s National Cyber Security Coordinator Michelle McGuinness and Director of the National Office of Cyber Security Stephanie Way outlined how the nation is driving to strengthen resilience amid rising geopolitical tensions, aggressive cybercriminals and fears of a catastrophic attack impacting Australia’s critical infrastructure.
McGuinness said Australia has made significant progress in building what she described as a “whole of nation endeavour” around cybersecurity, moving the issue beyond technical experts and into everyday life.
“We have every reason to and every right to thrive in the digital ecosystem,” McGuinness said, while adding that Australians must stop seeing cyber threats as someone else’s problem.
Governments worldwide confront a worsening cyber threat environment, driven by ransomware groups, nation state actors, supply chain weaknesses, and scams fuelled by advances in technology and AI.
Despite years of cybersecurity investment and awareness campaigns, McGuinness admitted that many breaches still stem from simple mistakes that attackers continue exploiting successfully.
“The top three items there is multi-factor authentication (MFA). Always apply it. Have unique and complex passphrases of 15 characters or more on each of your accounts and update your software,” she said.
She added that even in highly technical forums, these basic protections continue to account for “the majority of incidents across our ecosystem.”
Way said the government’s “Act Now Stay Secure” campaign has helped humanise cybersecurity conversations among everyday Australians, pushing the issue into mainstream culture through platforms like Netflix and Instagram.
The campaign is part of a broader effort to dismantle outdated stereotypes around cybersecurity.
“We really need to ensure that Australians are smart enough and sensible enough to mitigate those threats and keep themselves safe,” Way said.
McGuinness also argued Australia must remove the stigma associated with falling victim to cybercrime, particularly as scams become more sophisticated and widespread.
“We don’t want people to be ashamed and embarrassed,” she said. “We want them to reach out for help.”
While headlines often focus on the technical aspects of cyberattacks, Way said the real world consequences on businesses and individuals are frequently devastating and disheartening.
“When these businesses are hit by cybercrime and it’s a ransomware incident, it is the most horrendous and stressful time for them,” Way said.
She described cybercriminals as opportunistic actors “walking through car parks, just pulling every handle and seeing which door opens,” warning that attackers are not always targeting major enterprises specifically.
Way said many smaller organszations, including healthcare providers and critical service operators often underestimate their exposure.
“They would think, why would anybody come looking at my business and I’m just a small medical provider,” she said.
Once attackers gain access, however, the consequences quickly escalate into deeply personal and emotionally damaging situations.
“What they’ve done is extremely egregious,” Way said
McGuinness acknowledged that while Australia has not yet experienced a nation wide catastrophic cyber event, authorities operate under the assumption that such a scenario remains possible every single day.
“We’re not going to stop every attack,” she said. “There is no way we’re going to.”
Instead, government agencies are focusing heavily on preparedness, communication, and resilience.
“Preparedness is the greatest cure,” McGuinness said.
Way pointed to lessons learned from crises like bushfires and the COVID-19 pandemic as blueprints for how the country would respond during a major cyber emergency.
“It’s not about pointing fingers and blame and how this started or where it came from. It’s about how do we get through this,” she said.
The pair also reiterated Australia’s response during the CrowdStrike outage as evidence that collaboration between government, industry and emergency management agencies can work under pressure as a unit.
As global instability intensifies, McGuinness cautioned geopolitical tensions are reducing the amount of warning governments receive before cyber threats emerge.
“Geopolitical tensions reduces our warning time,” she said.
Still, she argued Australia’s strategy must remain “threat agnostic,” meaning organisations should build resilience capable of withstanding multiple scenarios rather than focusing narrowly on one adversary.
Way added that businesses must urgently assess supply chain vulnerabilities and dependencies before they become crisis points.
“We know there are huge supply chain critical points where we are vulnerable,” she said.
McGuinness also called for a broader rethink of cybersecurity talent and workforce development, saying the country remains short approximately 30,000 cyber professionals.
But she stressed cybersecurity is no longer just for technical operators sitting behind glowing computer screens.
“It actually requires strategic thinkers, it requires problem solvers, it requires innovators and collaborators and leaders and policy experts,” she said.
The trust between industry and government…particularly encouraging companies to report incidents earlier without fear of public backlash or regulatory punishment.
McGuinness said legislative reforms under Australia’s Cyber Security Act introduced “limited use obligations,” allowing companies to speak more openly with authorities during incidents.
“What that means is that Steph and I… and our team, can have discussions with leaders, businesses, industry who’ve had an incident and the information they share with us is limited,” she said.
Way said companies that engage early with government often navigate crises more effectively, particularly when managing communications, customers, and shareholders during active incidents.
“We’re really trying to change that tone and narrative around the shame that people experience,” Way said.
Watch the full interview here: https://kbi.media/interview/ltgen-michelle-mcguinness-and-stephanie-way/
