By Chong Shao
The IIS team attended AISA CyberCon 2026 in Melbourne on 14-16 October, joining thousands of delegates at Australia’s largest cyber security conference.
It was good to catch up with familiar faces across our clients, partners and the wider industry. The conference covered an enormous range of topics, from highly technical security issues to law, risk, governance and AI. The busy exhibition hall was also a reminder of how much activity and investment there is in the cyber security market.
There was plenty to take in over the three days. Looking back, what struck us was how much of the discussion came back to familiar issues: people, accountability and getting the basics right.
Here are three of our key takeaways.
1. AI is changing cyber security, but the picture is more complicated than it seems
Unsurprisingly, AI was a major topic throughout CyberCon. Speakers discussed how AI is making it faster and easier to find and exploit software vulnerabilities, potentially shrinking the time organisations have to respond from months or weeks to days or even hours.
Anthropic’s Deputy CISO Jason Clinton warned that the next 18-24 months could be particularly difficult for cyber security professionals as these capabilities become more widely available. That warning took on added significance as the events of ‘Black October’ unfolded shortly after CyberCon, with a wave of critical software vulnerabilities, cyberattacks and security incidents reported in quick succession.
However, the discussions were more nuanced than simply predicting an AI-driven cyber disaster.
One of the more interesting presentations came from investigative journalist Geoff White, who examined the workings of organised cybercrime groups. Drawing on his interviews with cybercriminals, White suggested that criminals may be slower to adopt AI than we assume. Some use it for routine tasks and analysing stolen data, but are reluctant to trust it with sensitive operations where mistakes could expose them.
We often hear that attackers only need to succeed once, while defenders need to be right every time. White challenged this assumption. Criminals also need to get many things right, often repeatedly, to avoid detection, maintain access to systems and ultimately profit from their activities.
AI may change the balance, but defenders have advantages of their own, including the resources and incentives to invest in new capabilities over the longer term.
2. Getting back to basics, and asking who is responsible
Jen Easterly, former Director of the US Cybersecurity and Infrastructure Security Agency (CISA), set the tone early for the conference with her opening keynote.
Easterly challenged the way we think about software security. When an organisation suffers a cyberattack, the immediate questions often concern whether it patched its systems, trained its staff or took adequate security precautions. But why do we so readily accept that software is released with serious security vulnerabilities in the first place?
Easterly suggested that we should stop calling these vulnerabilities and start treating them as product defects. Rather than putting so much responsibility on the organisations using technology, we should expect more from the companies developing and selling it.
This was a useful reframing, and one that could equally apply to AI developers. As AI systems become more capable, the responsibility to anticipate and address potential harms should not fall entirely on the organisations and individuals using them.
Of course, that doesn’t relieve organisations of their own responsibilities. Other sessions on cyber incidents, regulatory decisions and third-party risks reinforced familiar lessons: know your systems and data, understand your dependencies, test your controls and backups, and have a plan for when things go wrong.
Having policies, frameworks and completed assessments is not necessarily evidence that security controls are working. Organisations need to be able to demonstrate that their arrangements are appropriate, effective and regularly tested.
3. Cyber security is still fundamentally about people
Perhaps the most entertaining reminder of this came from ethical hacker Freaky Clown, who described how he had gained access to a secure government building.
FC initially told the front desk that he had forgotten something inside and was readily allowed through. Once he reached an area occupied by staff, he began taking photographs, even climbing higher to get a better view. Nobody challenged him, and the only person who said anything asked whether they were going to appear in a magazine.
It’s a humorous example, but also a worrying one. For all the money spent on physical and technical security, sometimes the simplest weaknesses are human ones.
This was a recurring theme throughout CyberCon. Our human tendencies – to trust others, take shortcuts or simply not pay attention – can undermine even sophisticated security measures. But people are also an organisation’s greatest asset – through their ingenuity, judgment and ability to recognise and respond to threats.
The answer cannot simply be more training or telling people to be more careful. We also need to design systems and processes that anticipate mistakes, limit their consequences and make it easier for people to do the right thing.
Conclusion
Despite the warnings about AI and the growing cyber threat, the atmosphere at CyberCon was positive and welcoming. There was a strong sense that the industry needs to work together, sharing knowledge and experience rather than trying to solve everything independently. That fitted the conference’s theme of Empowered Together.
Our main takeaway is that, for all the changes AI is bringing, many of the fundamentals of cyber security remain the same. The challenge is to put them into practice, and to recognise that responsibility for security needs to be shared between technology providers, organisations and the people using their systems.