Australia’s board security baseline: why containment now outranks prevention

At a glance

What this is: Illumio’s analysis of Australian board guidance argues that cyber resilience now depends on assuming compromise and containing blast radius, not just trying to prevent intrusion.

Why it matters: For IAM, NHI, and security teams, the article reinforces that access scope, segmentation, and third-party controls now sit inside board-level resilience expectations, not just operational hygiene.

By the numbers:

• espionage alone cost the economy $12.5 billion in FY23–24

Context

Australia’s new board guidance is best read as a governance response to repeated compromise, not as a technology shopping list. The core problem is that prevention alone no longer matches attacker persistence, legacy exposure, or supplier access paths, so boards are being pushed toward containment, visibility, and critical-asset protection.

That matters to identity programmes because containment depends on who and what can move after initial access. Segmentation, least privilege, third-party access boundaries, and service account scope all become part of resilience governance, especially where NHIs or delegated access can turn a single foothold into lateral movement.

Key questions

Q: What fails when organisations rely on prevention instead of containment?

A: Prevention-only strategies fail when an attacker gets past the first control, because broad connectivity and standing privilege let the incident spread faster than defenders can respond. Containment limits blast radius, protects critical services, and preserves operational continuity even when one identity, host, or supplier account is compromised.

Q: Why do legacy systems and supplier access increase cyber resilience risk?

A: Legacy systems often preserve older trust relationships, while supplier access can create broad, difficult-to-monitor pathways into internal environments. Together they widen the set of routes an attacker can use after entry. That is why boards are being pushed to ask not only who can get in, but how far they can move once inside.

Q: How do security teams know whether containment is actually working?

A: They should test whether the identity can still execute privileged actions after revocation, not just whether the API call succeeded. A working containment model prevents re-escalation, blocks credential regeneration, and remains effective even when the target is polling for state changes. If any of those fail, containment is only partial.

Q: Who should be accountable for cyber containment in board reporting?

A: Board accountability should sit with the executives who own resilience, risk, and technology oversight, but the controls themselves span security, IAM, infrastructure, and supplier governance. The important test is whether the board can see exposure to critical assets, not whether one team owns every control. Containment is a shared governance outcome.

Technical breakdown

Assume compromise changes the control model

Assume compromise means security planning starts from the likelihood that at least one control will fail. Instead of treating prevention as the final gate, the architecture shifts toward limiting what an attacker can reach after entry. That puts segmentation, asset criticality, and access scoping at the centre of resilience. In practical terms, the question becomes not whether intrusion is possible, but how far it can travel once it happens.

Practical implication: design controls around blast-radius reduction, not only intrusion blocking.

Why legacy systems and supplier access widen the attack path

Legacy systems often remain trusted longer than they should, while supplier access introduces paths that are harder to monitor and segment consistently. That combination creates pivot points: one weak endpoint or partner connection can expose systems that should have been isolated. The article’s emphasis is not on a single product category but on architecture that prevents trust from spreading automatically across old infrastructure and third-party links.

Practical implication: isolate unsupported systems and constrain supplier access to narrow, monitored paths.

Controlling lateral movement across identities and workloads

Lateral movement is the stage where containment either works or fails. In identity terms, standing privilege, broad service account scope, and weak separation between workloads allow attackers to reuse one foothold across multiple systems. In NHI-heavy environments, the risk is not only human admin access but also tokens, service identities, and delegated permissions that persist after the first compromise. Good containment shortens that movement chain before the attacker reaches critical assets.

Practical implication: tighten workload and service identity scope so one compromise cannot become a platform-wide event.

Threat narrative

Attacker objective: The attacker’s objective is to turn one successful foothold into broader access to critical assets and operational disruption.

1. Entry occurs through an exposed or under-segmented system, often amplified by third-party access or legacy weakness.
2. Escalation follows when the initial foothold can reach additional systems because trust boundaries are too broad.
3. Impact occurs when the attacker reaches critical assets, data, or operational systems before containment can stop movement.

Breaches seen in the wild

• Poland ArcGIS password leak 2023: An ArcGIS login emailed in 2020 was published from stolen mail in 2023 and still worked, exposing Polish military and infrastructure maps.
• Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Containment is now a board governance control, not a technical afterthought. The ASD and AICD guidance reflects a broader shift in security accountability: directors are being asked to understand how compromise will be limited, not just how it will be prevented. That changes the governance conversation from control presence to control effectiveness under attack. The practitioner conclusion is that resilience now depends on limiting blast radius across users, workloads, and supplier pathways.

Legacy trust is the real governance debt in many environments. Unsupported systems and embedded exceptions create persistent routes for pivoting even when perimeter controls look strong. This is especially relevant where human and non-human identities inherit access from older architectures that were never designed for fine-grained segmentation. The practitioner conclusion is to treat inherited trust as a measurable exposure, not an operational inconvenience.

Supply chain oversight and identity scope are converging into the same risk problem. Third-party access is not only a procurement issue, it is a control-boundary issue that can determine how far compromise spreads. Where suppliers, service accounts, and internal systems share broad reach, segmentation becomes a governance requirement. The practitioner conclusion is that access design must now be reviewed as part of third-party resilience, not only IAM administration.

Attack containment has become the practical expression of cyber resilience. This guidance validates a model where visibility, isolation, and access restriction define operational maturity more than alert volume or prevention claims. For identity and NHI teams, that means the security question is whether access can be revoked, segmented, and observed fast enough to matter. The practitioner conclusion is to align identity governance with containment outcomes, not just audit outcomes.

From our research library:

• Secrets management is a top five cybersecurity priority for only 33% of organisations, behind cloud security (45%), API security (42%), and endpoint security (36%), according to the 2024 State of Secrets Management Survey.
• Read next: Identity Provider and SSO Security Guide

What this signals

Containment is becoming the governance unit that boards can actually measure. Once compromise is assumed, the meaningful questions are whether critical systems are isolated, whether supplier access is constrained, and whether the environment can stop a foothold from becoming a broader incident. That shifts security reporting toward reach, segmentation, and access boundaries instead of raw alert counts.

Identity scope now sits inside cyber resilience planning. Human accounts, service identities, and delegated supplier access all shape how far an attacker can move after entry, so IAM teams are no longer working on a separate control plane. The practical programme question is whether access design would still hold if one credential, token, or vendor connection were abused.

Secrets management remains a relative blind spot in board priorities, even as access control becomes more central. Secrets management is a top five cybersecurity priority for only 33% of organisations, behind cloud security (45%), API security (42%), and endpoint security (36%), according to the 2024 State of Secrets Management Survey. That gap matters because containment fails faster when long-lived credentials and hidden access paths are not governed tightly.

For practitioners

• Define board metrics for containment readiness Track whether critical assets are isolated, whether third-party access is segmented, and whether the organisation can limit movement after a foothold.
• Map legacy systems to compensating controls Document unsupported systems, identify the pathways they provide into higher-value assets, and assign isolation or compensating controls to each one.
• Review service and supplier access scopes Reduce broad access for vendors, service accounts, and delegated identities so that a compromise in one zone cannot traverse the environment unchecked.
• Test containment against lateral movement paths Simulate how an attacker would move from an initial foothold to critical systems, then measure whether segmentation and least privilege stop that path.

Key takeaways

• The article reframes cyber resilience as a containment problem, not a prevention-only problem.
• Australia’s board guidance pushes critical assets, legacy systems, supplier access, and detection into the same governance conversation.
• For identity teams, the practical test is whether compromised access can be contained before it reaches critical systems.

Key terms

• Assume compromise: A design principle that assumes an attacker may already be present in some part of the environment. Controls are then built to limit blast radius, detect movement, and preserve recovery options. In identity programmes, it means access and trust cannot rely on a perfectly protected internal network.
• Lateral Movement: A post-compromise technique where an attacker uses a compromised NHI to move through a network, accessing additional systems and escalating impact without triggering detection.
• Containment: The phase of incident response that stops an incident from spreading while preserving the evidence needed to investigate it. In cloud environments, containment often starts with identity revocation, isolation of workloads, and protection of logs before any system is terminated or cleaned up.
• Third-party access segregation: Third-party access segregation is the practice of separating external users, vendors, contractors, and partners from internal identities and systems so their access is limited and easier to control. It uses distinct accounts, scoped permissions, network boundaries, and monitoring to reduce lateral movement, privilege overlap, and unintended exposure across shared environments.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps practitioners connect identity controls to the resilience outcomes boards now expect.