Topic starter
11/07/2026 8:21 pm
TL;DR: Australia’s ASD and AICD say boards should now assume compromise, prioritise containment, and focus on critical assets, legacy systems, detection, and supply chain oversight after cyberattacks have hit health, telecom, insurers, and government, with espionage costing $12.5 billion in FY23 to 24, according to Illumio. The governance shift is clear: resilience now depends on visibility, segmentation, and access control, not prevention alone.
Editorial analysis by NHI Mgmt Group, based on content published by Illumio: “Australia’s New Boardroom Baseline: 5 New ASD and AICD Security Priorities”.
By the numbers:
- espionage alone cost the economy $12.5 billion in FY23–24
Key questions
Q: What fails when organisations rely on prevention instead of containment?
A: Prevention-only strategies fail when an attacker gets past the first control, because broad connectivity and standing privilege let the incident spread faster than defenders can respond.
Q: Why do legacy systems and supplier access increase cyber resilience risk?
A: Legacy systems often preserve older trust relationships, while supplier access can create broad, difficult-to-monitor pathways into internal environments.
Q: How do security teams know whether containment is actually working?
A: They should test whether the identity can still execute privileged actions after revocation, not just whether the API call succeeded.
Practitioner guidance
- Define board metrics for containment readiness Track whether critical assets are isolated, whether third-party access is segmented, and whether the organisation can limit movement after a foothold.
- Map legacy systems to compensating controls Document unsupported systems, identify the pathways they provide into higher-value assets, and assign isolation or compensating controls to each one.
- Review service and supplier access scopes Reduce broad access for vendors, service accounts, and delegated identities so that a compromise in one zone cannot traverse the environment unchecked.
Bottom line: The article reframes cyber resilience as a containment problem, not a prevention-only problem.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 8:51 pm
Containment is now a board governance control, not a technical afterthought. The ASD and AICD guidance reflects a broader shift in security accountability: directors are being asked to understand how compromise will be limited, not just how it will be prevented. That changes the governance conversation from control presence to control effectiveness under attack. The practitioner conclusion is that resilience now depends on limiting blast radius across users, workloads, and supplier pathways.
A few things that frame the scale:
- Secrets management is a top five cybersecurity priority for only 33% of organisations, behind cloud security (45%), API security (42%), and endpoint security (36%), according to the 2024 State of Secrets Management Survey.
A question worth separating out:
Q: Who should be accountable for cyber containment in board reporting?
A: Board accountability should sit with the executives who own resilience, risk, and technology oversight, but the controls themselves span security, IAM, infrastructure, and supplier governance. The important test is whether the board can see exposure to critical assets, not whether one team owns every control. Containment is a shared governance outcome.
👉 Read our full editorial: Australia’s board security baseline: why containment now outranks prevention