AusCERT2018 DAY 1 - BRIAN BRUSHWOOD (DARREN KITCHEN WELCOME) AUSCERT 2026-09-17 | AusCERT2018 DAY 1 - BRIAN BRUSHWOOD (DARREN KITCHEN WELCOME)
The Human Side of Cyber: Changing Security Behaviours with Kelsy Luengen AUSCERT 2026-08-18 | Kelsy Luengen returns to Share Today, Save Tomorrow to explore why effective cyber security starts with understanding people, not just technology.Drawing on her background in criminology and her role as Senior Security Influencer at SEEK, Kelsy discusses how organisations can move beyond awareness training to address the behaviours, norms and motivations that shape security culture. Tune in to discover why changing security behaviours starts with understanding the humans behind the keyboard.
When Critical Infrastructure Is Hacked: Inside Industrial Incident Response with Lesley Carhart AUSCERT 2026-08-04 | What happens when a power plant, train network or other critical infrastructure is targeted by a cyber attack?In this episode of Share Today, Save Tomorrow, Lesley Carhart shares what it's really like investigating cyber incidents affecting industrial systems, an area of digital forensics and incident response that few people ever get to see.Lesley discusses the different types of incidents impacting operational technology (OT) environments, from ransomware and insider threats to nation-state activity, and explains why understanding how systems fail is essential to building resilient critical infrastructure.
Podcast ep 62: Cyber Security Through the Eyes of a Teenager with Somindu Abeydeera AUSCERT 2026-07-21 | In this episode of Share Today, Save Tomorrow, AUSCERT’s Business Manager Bek Cheb sits down with one of the youngest voices in Australia's cyber security community, Somindu Abeydeera.What started with a lockpick set at six years old has grown into a passion for ethical hacking, conference speaking and continuous learning. Somindu shares how physical security sparked his interest in cyber security, why curiosity has been his greatest teacher, and how he made the leap from lockpicking competitions to presenting at industry events.The conversation also explores the importance of hands-on learning, the value of community, the future of cyber security for young people, and Somindu’s perspective on Australia's social media age restrictions.
AUSCERT Member Testimonial - Technical Networks AUSCERT 2026-07-14 | AUSCERT2026 Organisation of the Year winner Canstar, represented by Katie Lonergan, shares how AUSCERT brings together diverse technical communities to strengthen and support the wider cyber security community.Join today: https://auscert.org.au/become-a-member/
AUSCERT Member Testimonial - Inclusion AUSCERT 2026-07-10 | AUSCERT2026 Diversity and Inclusion winner Nivedita Newar from UNSW shares how AUSCERT brings together organisations to support and learn from each other. Join today - https://auscert.org.au/become-a-member/
AUSCERT Member Testimonial - Community Value AUSCERT 2026-07-10 | AUSCERT2026 Individual of the Year winner Nikki Peever discusses the value of staying connected to the AUSCERT community and what it means for her organisation, CAUDIT.Join today - https://auscert.org.au/become-a-member/
AUSCERT Member Testimonial - Services AUSCERT 2026-07-09 | Shannon Hartley from CEnet shares how AUSCERT services, such as Sensitive Information Alerts and Member Security Incident Notifications, are particularly valuable to his organisation. Join AUSCERT today: https://auscert.org.au/become-a-member/
AUSCERT Member Testimonial - Tabletop Exercise AUSCERT 2026-07-09 | Franz Eilert from Translational Research Institute shares why AUSCERT's Tabletop Exercise is the "key to having a successful resilience exercise" Learn more about our Tabletops: https://auscert.org.au/services/tabletop-exercises
Elese Cox - DDoS, Doxxing, and Digital Warfare: Cybersecurity Lessons from the Gaming Trenches AUSCERT 2026-06-24 | In enterprise cybersecurity, we deal with DDoS attacks and exploits using structured security frameworks, enterprise-grade tools, and funded teams. But what happens when you strip all of that away? No SOC, no enterprise firewall, no corporate budget - just a handful of volunteers using whatever security measures they can piece together.That’s the reality of running a Grand Theft Auto (GTA) Roleplay server, which is a multiplayer modification of GTA - players create unique characters in a persistent, player-driven world with custom rules, jobs, and interactions.In the gaming industry, threat actors aren’t always like the ones we deal with in the corporate landscape where things like financial gain or competitive advantage motivate. Our most common threat actors are driven by ego, chaos, and pettiness. They’re not sophisticated APTs - they’re a new evolution of script kiddies who will spend days reverse-engineering server exploits, DDoSing for revenge, or doxxing staff because they lost a virtual shootout.As the general manager of one of these popular servers, I’ve had to defend against security threats with none of the luxuries of corporate cybersecurity.This session is a raw, unfiltered look at cybersecurity in an environment with zero safety nets. Using real footage, screenshots, and case studies, I’ll show how we built defences, fought back, and learned valuable security lessons, all with a team of people - some of whom I’ve never met in real life, but had to trust with keeping everything secure.Beyond just gaming, this talk highlights wider cybersecurity lessons in risk management, security resilience, and defending against persistent threats with limited resources so you, as the listener, can take some of my learnings and make your business more secure and resilient.
The Honest Debrief - What It Actually Takes to Evolve Security for the AI Era AUSCERT 2026-06-18 | Every shift in the threat landscape has security evolve. AI is the most significant shift yet and many security programs are still running on an architecture designed for a world that no longer exists. Fragmented tools, disconnected signals, and reactive postures create the illusion of control not the resilience organisations actually need.In this session, Field CISO Andrew Philp outlines how security strategy needs to evolve for the AI era from the case for consolidation through to what it takes to build a function that can keep pace with both innovation and threat. Andrew is then joined by industry peers for a candid discussion on what this looks like in practice where maturity gaps are most exposed which decisions have materially shifted outcomes and how to move forward while staying aligned to business priorities. You will gain a strategic direction from the field, a practical reality from those navigating it every day.
Brett Williams - When Attackers Use AI: How Defenders Can Respond AUSCERT 2026-06-18 | Threat actors now use AI to scale social engineering, accelerate vulnerability discovery, and craft targeted prompt injection attacks. Nation-states and cybercrime groups use the same tools to automate reconnaissance, generate malware variants, and refine influence operations. At the same time, employees and developers use AI across daily workflows. This dual use shifts the risk equation. AI is now both a productivity engine and an attack surface.This session examines the modern cybercrime ecosystem and the common AI-enabled tradecraft used by criminal syndicates and state-aligned actors. It maps how AI is applied across the attack lifecycle, from initial access and payload development to fraud, extortion, and data exploitation.The session then outlines a practical response and draws on the comprehensive guidance on AI adoption, co-authored by ASD, CISA, NSA, and NCSC. It focuses on governing AI interactions in real time - blocking malicious inputs, preventing sensitive data disclosure, and detecting abnormal usage patterns. It examines how Security teams can move beyond the role of innovation gatekeeper by deploying enabling controls that act as financial and operational guardrails.We will explore the role of AI runtime defence in anomaly detection and resource abuse prevention, alongside AI Usage Control for visibility, policy enforcement, and Shadow AI governance. The outcome is measurable risk reduction, improved oversight, and a defensible strategy for scaling AI safely across the enterprise.The session will also include a live demonstration of AI attacks in action and how emerging AI security tools can assist the defender.
Emile Bakarat - Make Your Business a Hard Target for Cybercriminals AUSCERT 2026-06-18 | When it comes to potential targets for cyberattacks, easier to breach means more likely to fall victim. While you might not be able to influence your perceived value, there are changes that can eliminate your organization from being seen as an easy target. We’ll explore practical tactics to reduce your surface area of attack and controls to prevent lateral movement should a breach occur.
Nick Clark - The 16 Minute Breach: Why Human-Led Defense Fails Against Agentic AI AUSCERT 2026-06-18 | As enterprise AI adoption has surged—with a 91% year-over-year increase in transactions—the attack surface has fundamentally shifted. In early 2026, Zscaler ThreatLabz research identified that the median time to critical failure in enterprise AI systems is now just 16 minutes. We have entered the era of "Agentic AI" as a machine-speed attack vector, where autonomous agents handle reconnaissance, exploitation, and lateral movement faster than a human SOC can triage an alert.This session moves beyond the "Shadow AI" conversation to explore the reality of autonomous threats and the "Oversight Gap." We will analyse recent industry-shifting incidents, such as the Bob-p2p finance compromise and ClawHavoc supply chain poisoning, to demonstrate why traditional perimeter-based security is obsolete. Attendees will learn how to transition from human-speed reactive security to AI-powered Zero Trust and proactive AI Red Teaming, ensuring that defence can finally match the velocity of the modern, autonomous attacker.
Rahul Samant - The New Face of the Email Attack: When Everything Looks Legitimate AUSCERT 2026-06-18 | Email threats in Australia have crossed a threshold. The attacks arriving in inboxes today look nothing like what security teams were trained to catch. We'll walk through real examples targeting Australian organisations right now: invoice fraud that manufactures entire approval chains, credential theft routed through legitimate trusted Cloud services, and AI-personalised campaigns that scale in seconds. Then we'll explore how traditional defences try to keep up, and why the gaps are widening.
Mick Davies - The Ghost in the Machine: AI Automated Attacks From Inside & Out AUSCERT 2026-06-18 | Every day, millions of people interact with AI through chat interfaces and terminal applications without realising how easily those sessions can be hijacked, manipulated, or weaponised. This isn't a talk about theoretical risk. It's a live, demo-driven session where you'll watch prompt injection attacks unfold in real time, see open-source model guardrails ripped out through abliteration, and discover how exposed many existing chat interfaces really are. Some of what you see will surprise you. Some of it should worry you.Then we flip the script. Using defence-in-depth, gateway controls, guard models, and practical security patterns; you'll see those same attacks stopped cold. And you won't just be watching. The audience plays a part in how this one unfolds.No death-by-slides. You'll leave with a clear picture of what AI prompt attacks actually look like, why your current setup may not be catching them, and practical defences you can start applying today.
Welcome to AUSCERT2026 AUSCERT 2026-06-18 | Back again to MC is our favourite mathematician and yours, Adam Spencer!AUSCERT2026 opens with a Welcome to Country, acknowledging the Traditional Custodians of the land and paying respect to Elders past and present.
Welcome from AUSCERT GM Ivano Bongiovanni AUSCERT 2026-06-18 | AUSCERT General Manager Ivano Bongiovanni will then provide an update on the state of AUSCERT, reflecting on the past year, and the organisation’s role within the cyber security community.
Game On! The AUSCERT Challenge AUSCERT 2026-06-18 | Let's kick off AUSCERT2026 with fast facts, friendly rivalry and a walk down memory lane.Hosted by the incomparable Adam Spencer, this high‑energy quiz showdown pits two teams against each other, captained by cyber heavyweights and backed by AUSCERT team. Expect conference lore, unforgettable moments from the last 25 years, and a few clues about what’s still to come as we celebrate the past, present and future of AUSCERT Conferences.
Daniel Schell - How Attackers Play the Endpoint - and How to Break the Game AUSCERT 2026-06-18 | What if you looked at your endpoint the way an attacker does—not as a system to defend, but as a game to win? This talk reframes modern endpoint compromise as a series of repeatable strategies drawn from a well-understood playbook. Despite the apparent complexity of malware, ransomware, and post-exploitation frameworks, most attacks rely on a small set of foundational techniques: gaining code execution, evading controls through in-memory and "living off the land" methods, and chaining these primitives to achieve persistence and impact.Through a structured breakdown of these core "moves," this session deconstructs real-world attack patterns and shows how attackers consistently succeed—now increasingly accelerated by AI-assisted tooling. By understanding the strategy guide attackers implicitly follow, defenders can stop reacting to individual threats and instead target the underlying mechanics that make compromise possible.The session provides concrete defensive approaches, including deny-by-default and application control strategies, that materially limit attacker options at the endpoint. The goal is simple: if you understand the rules of the game, you can start to change them.
Somindu Abeydeera - Cognitive Warfare: When Defenders Stop Updating Their Mental Model AUSCERT 2026-06-18 | Australia’s social media ban for under 16 has been one riddled with problems, affecting children and parents alike with the use of invasive measures to keep children out, that consistently spit false positives, yet simultaneously are trivially bypassed by the attackers, by the children. The juniors of our world are starting to become ever more present in the cyber world, with pirating software, evading bans and firewalls, starting to build up. In this era where cyber is riddled with seniority and authority biases, children aren’t given room. Psychologically, this exposes how biases and slow belief updating cause designers to underestimate adaptive behaviour, especially when it comes from groups, they do not expect to be capable adversaries.This talk will reframe cyber defence as "cognitive warfare", where attackers are exploiting psychological inertia, delayed belief updating, culturally reinforced assumptions and more. Drawing on established findings in cognitive and behavioural psychology such as Ocean's Big Five model and the Behavioural Inhibition System (BIS), this talk will frame both blue, and red teaming as practices with deep personal psychological roots which are affected by the neurodiversity and personality traits of any person. I will examine how rapidly evolving actors outperform defenders, not through sophistication, but through flexibility. How in many cases, the fastest adaptations aren’t driven by experience, but by the absence of institutional assumptions.Rather than focusing on tools or detection logic, based on my experience playing both physical and online team CTF challenges, along with considerable research of the fields of psychology and cyber, this session will explore why adaptive thinkers with minimal institutional grounding often recognise emerging threats faster than highly experienced teams, and why failure to update internal mental world models has become one of the most reliable attack surfaces in modern security operations.
Andrew Aston - Beyond the Perimeter: Navigating Identity Exploitation in the Age of AI AUSCERT 2026-06-18 | The modern cyber threat landscape is characterised by the strategic erosion of traditional perimeters as adversaries increasingly favour identity exploitation over technical forced entry. By masking malicious traffic as legitimate local activity and leveraging specialised criminal ecosystems, attackers can now escalate minor breaches to full-scale operational paralysis in moments. This evolution is driven by autonomous, AI-enhanced systems capable of real-time learning and self-modification. These tools automate credential theft and bypass standard authentication via advanced social engineering, shifting the landscape toward a model where threat actors "log in" using stolen, high-privilege identities rather than breaking through traditional defences.This rapid automation exists alongside a "patient persistence" approach favoured by sophisticated actors who maintain dormant access within critical infrastructure and industrial controls for extended periods. The risk is further expanded by vulnerabilities within emerging technology supply chains and internal corporate AI integrations, which can be turned into high-speed conduits for unauthorised data exfiltration. Consequently, organisation must adopt a dual-track defensive strategy: one that counters the machine-speed execution of adversarial algorithms and another that addresses the deep-seated systemic risks posed by non-human identities and long-term stealth operations.
iTnews State of Security Report 2026 AUSCERT 2026-06-18 | For over 20 years, iTnews has been the leading source of breaking news for the Australian technology sector, providing CIOs, CISOs and technology teams with their daily fix of accurate, up-to-the-minute news, analysis and research. Our end-user tech audience leverage the site to inform their strategy, make business cases for technology investments, set policies and chart their careers.In 2022, iTnews launched the first State of Security report, a collaborative deep dive into the cyber security sector, analysing the ever-evolving cyber threat landscape. In its fifth iteration, the 2026 State of Security report uncovers the key trends, challenges and end-user CISO case studies.
Jess Dodson - GAME OVER! Start again? Getting Security Right From the Start AUSCERT 2026-06-18 | It’s 2026...and too many organizations are still burning lives on avoidable misconfigurations - breaches, data leaks, and frantic post‑mortems that feel like a never-ending GAME OVER screen. This talk will present how to start again the right way: by baking in the “boring basics" that stop real‑world compromises before they start.Drawing on over two decades of hard‑won experience - and an evergreen “back‑to‑basics” session refreshed for today’s reality - you’ll see exactly which foundational controls are still missed, why they’re skipped (because it's always "not now"!), and how to land them across hybrid cloud, SaaS estates, and AI‑enabled workflows.Expect opinionated guidance, vendor agnostic advice, and field‑tested checklists you can apply on Monday morning, delivered the way only Jess can. Walk away with a starter blueprint for secure‑by‑default builds and the confidence to keep your organisation out of boss‑fight wipeouts. No cheats required - just great fundamentals.
Zane Jarvis - Flattening the SOC: Re-thinking Tiered Operations to Improve Outcomes AUSCERT 2026-06-18 | Traditional Security Operations Centres (SOCs) are commonly structured around rigid tiered models (Level 1–3), optimised for ticket throughput rather than security outcomes. While widely adopted, this approach often introduces friction: alert fatigue at the lowest tiers, slow escalation paths, inconsistent decision-making, and high analyst attrition driven by repetitive, low-context work.This session presents a practical case study of restructuring a SOC to remove traditional tiers and instead empower the most senior analysts to directly drive alert triage and operational decision-making. By flattening the operational model, the SOC shifted from an escalation-driven workflow to one focused on rapid context-rich analysis, ownership of outcomes, and deliberate use of automation to support—not replace—human judgement.This session is aimed at SOC leaders, security managers, and senior analysts looking to modernise operations, improve outcomes, and build sustainable teams in an increasingly complex threat landscape.
Matthew Pokarier - Incident Response: What Security Teams Need to Know (legal one) AUSCERT 2026-06-18 | Focus:• Legal obligations during and after a cyber incident• Breach notification timing, evidence preservation, and legal professional privilege - including when privilege applies (and when it doesn’t)• Common mistakes that increase regulatory exposure• Legal risks of ransom payments (sanctions, terrorism financing, AML laws) and how these interact with conflicting disclosure laws and regulator expectationsAbstract:When a cyber incident occurs, the first 24-72 hours determine both the legal exposure and the quality of recovery.This session distils what security teams must get right (fast) and provides practical guidance on actions that can be implemented immediately.The session will cover the triggers and sequencing of legal obligations from discovery to containment, clarify when and how to notify affected parties and regulators, outline the mechanics of preserving evidence and explain how to structure workstreams to maximise legal professional privilege (and avoid pitfalls).We’ll also cover the evolving rules of engagement on ransom-related risks, including sanctions, terrorism financing, and AML exposure, and Australia’s mandatory ransomware payment reporting regime and show how these elements interact with disclosure expectations from regulators and boards.Delegates will leave with an incident checklist, an awareness of legal privilege and board ready talking points.Learning outcomes:Attendees will gain an understanding of:• The mandatory steps to take within the first 72 hours of a cyber incident and the information to produce at each step• Preserving evidence without impeding the response to a cyber incident and how to structure legal engagement to maximise privilege where it applies while avoiding common pitfalls• Ransom risk – how to assess sanctions and AML exposure, recognise what can and can’t be negotiated and how to comply with Australia’s ransomware payment reporting rules• How to navigate differing regulator expectations
Chris Horsley, Prescott Pym - Levelling up your CTI program with the CTI-CMM AUSCERT 2026-06-18 | Is your Cyber Threat Intelligence (CTI) program making a difference in your organisation? This session introduces the emerging and globally-developed Cyber Threat Intelligence Capability Maturity Model (CTI-CMM) - a structured assessment framework designed to help organisations assess and strategically enhance their threat intelligence operations.Designed for CISOs, analysts, and program managers, you will gain a solid understanding of the CTI-CMM's key domains and maturity levels, and how to use it to shape a clear CTI roadmap. We’ll go beyond theory with applications of the CTI-CMM based on our experience, providing practical insights that you can take home to your organisation.You'll walk away with steps to elevate the value CTI provides in your organisation from the technical to the executive levels. We’ll show you how CTI goes beyond IoCs to inform risk management, link to strategic goals, and inform your stakeholders. We’ll also leave you with a CTI-CMM v1.3 assessment tool that we developed at Cosive.
Eric Pinkerton - How much tech should a CISO know before a CISO passes GO? AUSCERT 2026-06-18 | If you want to know how technical a CISO actually is, ask them “How technical does a CISO needs to be?” and they will describe themselves!The perennial debate around this is like incandescent light in that the energy it consumes generates far more heat than light!This is a debate is that almost always devolves into a false dichotomy where organisations must to choose between someone who can launch nukes by whistling codes into a phone, Vs someone who routinely double clicks on hyperlinks.Worse, we pretend every CISO role is the same thing, despite knowing that LinkedIn is full of "CISOs" who are essentially firewall salespeople, while others are running security for critical infrastructure.In well over a decade of consulting I have been fortunate, and sometimes unfortunate enough to work with a large number of CISO’s, ranging from old school pen testers who run Gentoo on a MacBook, to people who required a personal assistant to print out their emails.My observation has been that the technical ability of a CISO is just one aspect in a much larger group of critical capabilities, and I have come to believe that whilst technical ability is highly desirable, it can be a double edged sword for a variety of reasons.What this talk will cover.- The Cases for and against Technical Capability- What other capabilities should a CISO possess- What different stakeholders want and why- Why different organizations need fundamentally different CISOs at different times- The skills we should be developing and at what point in our career?Join me in interrogating some of my own observations, biases and beliefs in the hope that we can spare future generations from dying on such pointless hills.
Critical Links: Strategic and Technical Risk Assessment of Pacific Submarine Cable Infrastructure AUSCERT 2026-06-18 | Submarine cables underpin 95% of intercontinental communications across the Pacific, forming a strategic backbone for national security, economic development, and allied interoperability. This presentation draws on Mercury Information Security Services’ recent analysis of submarine cable infrastructure across the Indo-Pacific to assess emerging risks to regional connectivity, operational resilience, and defence communications.Using the PMESII-PT framework, the study identifies critical single points of failure—most notably, a single cable, which carries up to 85% of active bandwidth between Australia and the United States. The session will explore the analytical process that informed this deduction and three high-impact threat scenarios, each with unique implications for Defence operations, regional stability, and sovereign control of communications infrastructure.We present findings from OSINT reconnaissance, static firmware analysis, and physical site assessments of cable landing stations in Australia and the Pacific. Key vulnerabilities include outdated firmware, exposed wireless systems integrated with sites, highlighting an urgent need for systemic resilience, sovereign fallback capabilities, and vendor assurance, and considerations for communication systems in the event of loss or degradation of links.This talk will conclude with actionable recommendations for Defence and industry stakeholders, including securing critical nodes, diversifying connectivity, and elevating communications infrastructure to a strategic planning priority in future contested environments.
Shanna Daly - Threat Intelligence for Smarter Risk Reduction AUSCERT 2026-06-18 | Many organisations still struggle to understand the full range of systems, services, and exposures that make up their environment. As technology expands into cloud, SaaS platforms, and mobile devices, it becomes harder to maintain an accurate view of what is actually in use and what may be at risk. Without this clarity managing security becomes reactive and often focused on the wrong place.This talk explains how using attack surface management and threat intelligence together can provide a more reliable picture of an organisation’s current exposure. Attack surface management shows what is visible from the outside including systems that may have been forgotten, misconfigured, or created without formal approval. Threat intelligence adds context about which weaknesses are being targeted and which issues are most likely to lead to real incidents.By combining these views, organisations can make more informed decisions about where to direct their attention. Instead of just responding, teams can identify risks earlier, understand why they matter, and act before they turn into incidents. This approach supports clear prioritisation and more effective use of resources especially in environments where teams are managing a large number of competing demands.The session will outline practical steps that technology and risk leaders can take to strengthen visibility and improve decision making. It will cover how to identify blind spots, how to link external information to internal systems, and how to recognise the areas that genuinely require attention. Attendees will gain an understanding of how external insights can support a more proactive approach to security, reducing uncertainty and improving overall risk management.
Hank Opdam - Skateboarding, Skydiving, Security - What can we learn from Extreme Sports? AUSCERT 2026-06-18 | Cyber professionals are often not heard, if they are heard then they are rarely understood.In this presentation Hank will share his approach to managing Cyber for some of Australia’s most critical infrastructure and high-profile organisations.Drawing on life lessons from extreme sports, he’ll share real examples of how he was able to shift Executive Management understanding, Cyber Awareness and Culture over his 20+ career through story-telling, gamification, incident explanation and demonstration.Hank will share some simple tools for communicating complicated technical topics to non-technical audiences and leave you with a stack of examples you can use when you walk out the door.
Under the Hood: The Battle for Security, Safety and Privacy in a Connected Vehicle World AUSCERT 2026-06-18 | As vehicle technologies rapidly evolve, so too do the threats that target them. Building trust, resilience, and confidence in our connected ecosystems has become a critical challenge, particularly as connectivity becomes a defining feature of modern vehicles. While this connectivity delivers unprecedented convenience, it also introduces new and often poorly understood risks.This presentation explores the expanding attack surface of the modern connected vehicle, examining the components that pose the greatest security, safety, and privacy risks. It takes the audience under the hood of a vehicle’s telematics box, the gateway that connects vehicles to the outside world via cellular networks and highlights how this access can be leveraged by attackers.Taking an evidence-based approach, the session dives deep into privacy challenges by analysing real data recovered from Australia’s best-selling vehicle for the past three years: the Ford Ranger. This analysis sheds light on the types of data being collected, stored, and potentially exposed, and what that means for drivers, organisations, and regulators alike.Beyond the vehicle itself, the presentation examines the broader implications for local, state, and federal governments, as well as industries such as mining, agriculture, and fleet operations where connected vehicles are deeply embedded in daily operations. The risks extend from employers and critical infrastructure all the way to individuals at home.
Hunting Nation-State APTs in Telecommunications Networks: Intelligence Lessons from the Front Lines AUSCERT 2026-06-18 | This presentation explores the escalating cyber threat landscape targeting the telecommunications (Telco) sector, emphasising its critical role in national infrastructure and connectivity. Telecommunications providers are prime targets for state-sponsored cyber threat actors due to their access to sensitive data, including communications, geolocation, and personal information.Recent high-profile cyber incidents such as attacks on Viasat, Orange, iiNet, and iPrimus, highlight the global scale and frequency of these threats, with nine major incidents reported in just three months of Q3, 2025. In the past three years there has been an increase in geopolitical tensions within Europe, Asia and the Middle East, particularly involving China, Russia, Iran, and North Korea, in shaping cyber operations against the global Telco sector.As geopolitical tensions rise there are observable frequencies of cyber-attacks against levels of all governments and their critical infrastructural assets. The human factor continues to be an Achilles heel within identified attack vectors ranging from sophisticated levels of phishing, spear phishing and supply chain attacks.Recent cyber-attacks by Nation Sponsored APTs such as Salt Typhoon and Volt Typhoon continue to demonstrate operational pivots towards Telecommunications critical infrastructure and their vendors. A threat hunt conducted in Q3 of 2025 by the NSW Department of Customer Service and NSW Telco Authority uncovered network scanning activity and indicators of compromise linked to Salt Typhoon.The second part of this talk will discuss the threat hunting process used by DCS and NSWTA, outline how critical intelligence gathering processes are, understanding the Intel Pyramid of Pain and utilising open and closed sources of intelligence.The presentation concludes by urging greater collaboration across agencies, government and private industry, to deploy rapid patching schedules, and conduct active threat hunting, while emphasising that cybersecurity is a collective responsibility requiring persistent effort using shared intelligence to defend against nation state threat actors.
From Zero to Global: A Founders Journey in Building a Successful Cybersecurity SaaS Company AUSCERT 2026-06-18 | Starting a company in the highly competitive and critical cybersecurity space presents unique challenges, from identifying a genuine market gap to securing early customers and scaling globally. This presentation offers an honest, firsthand account of the founder’s journey behind Avertro, a successful cybersecurity software platform. We will move beyond product pitches to explore the key decisions, strategic redirections, and hard-earned lessons learned while building a B2B SaaS business from the ground up. Topics covered include: obtaining early-stage funding, developing a unique technological and market perspective, building a high-performing culture, navigating the challenges of scaling, and the personal demands of cybersecurity entrepreneurship. Attendees will gain actionable insights into what it takes to succeed as a founder in the cyber industry.
Dylan Jones - Ready Player Three: Trawling Telegram for Threat Intelligence AUSCERT 2026-06-18 | Telegram is a dark place on a not-so-dark web. Beyond being a simple "messaging app" it is a haven where access brokers sell credentials, ransomware groups run leak channels, hacktivists publish target lists and predators share exploitation material. For these actors it offers the perfect combination: perceived security, minimal moderation and an immediate reach to anyone with an account.Collecting data is tricky, but the hard part is knowing what to do with it. Whether you're a threat hunter looking for leaked credentials, an intel analyst tracking data breaches or an investigator on a criminal case, you will leave this presentation with a practical understanding of what information Telegram holds and how to turn it actionable intelligence for your organisation. I will take you through the identification and analysis of message content, the mapping of user relationships, cross-channel activity, forwarding chains and data collection.Not only will you leave with a deeper interest in OSINT from Telegram, you will be provided with open source tooling so you too can proactively monitor and collect data from Telegram in real time.After all, "the most valuable commodity I know of is information". It's game on.
Alex Tilley - The real state of North Koreas employment fraud operations in Australia AUSCERT 2026-06-18 | North Korea’s program of infiltrating the workforces of Western countries for financial gain is finally receiving long overdue global attention. However, awareness and response within Australia still lag behind, often dismissed with the mindset that “this is a big tech problem in the United States.”Drawing on unique intelligence and visibility into this threat, Okta’s hard won research reveals the true scale and scope of the risk to Australian organisations across all industries, job categories, and roles, far beyond the stereotype of remote software developers.This presentation will outline the reality of the threat and provide practical steps that organisations can take to reduce the risk of inadvertently hiring sanctioned North Korean operatives. It is a practical, data driven session grounded in real world cases and hands on research with useful takeaways.
Scaling Capability or Scaling Risk? A Look at AI at the Coalface AUSCERT 2026-06-18 | Your AI isn't just a tool you're deploying, it's a target. And in some cases, the attack vector itself. Attackers have industrialised AI for scale to run automated pipelines that profile, target, and engage victims with no human bottleneck.Mick McCluney Field CTO ANZ at TrendAI joins a senior security leader from a major Australian organisation to share what’s been seen on the ground. Every organisation is deploying AI, yet fewer are asking the right questions first. We will unpack real world examples such as AI systems making decisions without governance to match, the new attack surfaces that weren't in the architecture diagram, and adversaries who got there first. If you've sat through enough sessions on AI's potential, this one is about what's actually happening, what's working, what's backfiring, and what security leaders are doing about it.
Kawin Boonyapredee - Beyond Bits: Defending Data in the Quantum Age AUSCERT 2026-06-18 | As quantum computing moves from theory to reality, organisations face dramatic shifts in both opportunity and risk. This talk succinctly defines quantum computing and clarifies the benefits such as accelerated simulation, optimisation, and new cryptographic primitives, alongside concrete threats, especially the risk quantum algorithms pose to widely deployed public-key cryptography and long-term confidentiality. We summarise the current global regulatory and legislative landscape shaping quantum readiness, highlighting major initiatives and standards that affect compliance and procurement. Finally, the session delivers an actionable roadmap for practitioners and decision-makers. Attendees will leave with clear, prioritised steps to reduce exposure and make measurable progress toward post-quantum resilience.
AUSCERT Cyber Leadership Network (CLN) AUSCERT 2026-06-18 | The AUSCERT Cyber Leaders Network (CLN) brings together senior cyber security leaders from across industry, government, education, and critical services to collaborate on emerging cyber security challenges, share practical insights, and develop community driven approaches to improving cyber resilience across Australia.This presentation will showcase the work of two active CLN working groups through presentations delivered by each Group Chair.Tim Lane (CISO, TURSA), will present on the Cyber Culture Metrics Working Group, exploring approaches to measuring cyber culture maturity, behavioural indicators, and the growing importance of human centred security metrics in organisational resilience.Mikhail Lopushanski (General Manager, Technology GRISC, Auto & General) unveils the AUSCERT CLN Quantum Computing Working Group's latest actionable artifacts. This session provides critical insights into the emerging "Harvest Now, Decrypt Later" threat, post-quantum cryptography strategies, and the concrete steps security leaders can take to drive immediate organisational preparedness.
Offensive security - Walking the fine red (team) line AUSCERT 2026-06-18 | Red teaming is a key component of offensive security. Red Teams mimic the tactics, techniques, and procedures (TTPs) used by malicious actors to expose your vulnerabilities. Their objective? To uncover your weak points before the bad guys do.But what makes a winning Red Team strategy?Our panel of industry experts discuss what they expect - from partner, vendor, and client perspectives - from a Red Team. How far is too far when leveraging social engineering to manipulate employees? How can you balance the trust deficit between Red and Blue Teams? What about the operational risks of working on a live production system vs a staged low-risk environment? Whether one expert constitutes a team, and more.Expect a lively debate over a range of ethical, political, psychological and cost considerations.
Peter Gutmann - Why Quantum Cryptanalysis is Bollocks AUSCERT 2026-06-18 | This talk looks at the quantocalypse set in the context of historical precedents like WWII military history and the 2008 global financial crisis, examining the implications for quantum cryptanalysis using purely evidence-based empirical sources without resorting to fallacies like appeal to authority and sky-is-falling speculation. The result is summarised in the title of the talk.
Chris Haller - ProfileHound: BloodHound collector for user profiles stored on machines AUSCERT 2026-06-18 | Modern red team objectives have shifted from onsite Active Directory toward compromising cloud services, SaaS applications, and hybrid identity systems. While BloodHound's HasSession edge reveals active user sessions, it misses a critical data source: user profiles that persist on disk. These profiles contain DPAPI secrets, cached credentials, SSH keys, cloud tokens, and browser data that enable lateral movement and privilege escalation without requiring an active user session.This presentation discusses ProfileHound, a new open-source post-escalation tool that collects user profile data from domain machines and exports it to BloodHound using the OpenGraph format. ProfileHound creates a new HasUserProfile edge that maps which domain users have local profiles on specific computers, including profile creation and modification timestamps. This visibility allows operators to identify high-value targets for secret looting, prioritize machines with long-lived profiles likely containing accumulated credentials, and focus collection efforts on systems where privileged users maintain active workstations.Attendees will learn how ProfileHound enumerates the C$ share to identify domain user profiles by correlating NTUSER.DAT ownership and DPAPI directory SIDs. The presentation covers practical Cypher queries to find profiles belonging to specific groups, identify recently active profiles, and filter out unused profiles that lack valuable secrets. Demonstrations will show how operators can chain ProfileHound data with existing BloodHound edges to build attack paths targeting users with access to sensitive SaaS applications or cloud administrative roles.Key takeaways include understanding why user profiles represent an underutilized intelligence source in Active Directory environments, how to deploy ProfileHound during authorized engagements, visualizing where profiles exist, and how to write custom Cypher queries that combine profile data with group membership and session information to identify the shortest path to post-exploitation objectives.
Justin Allen - Strength in Connections: The Anatomy of Managed Defence AUSCERT 2026-06-18 | Understand how Managed Security Operations provide resilience and expertise for the Australian Market, through unification Agentic (machine), Human (expert), and Connective (partner) layers to deliver scalable, 24/7 defence capability.
Chris Haigh - The Referee’s Playbook: Avoiding the Red Card ($5.8M Fines) and the Sin Bin AUSCERT 2026-06-18 | The Arena has changed.For 24 years, Australian CISOs played by guidelines. In 2025, the Referee blew the whistle. With the landmark Australian Clinical Labs (ACL) fine ($5.8M) and the Vinomofo determination, we now have hard case law defining exactly what "Reasonable Steps" look like in the eyes of the Federal Court and the Privacy Commissioner.This session reviews the "game tape" of these two major regulatory actions to create a winning defensive strategy for 2026. We will deconstruct the specific technical fouls cited in the judgments, from 1-hour firewall log retention and "temporary" cloud databases to the cultural failure of labelling privacy "The Boring Stuff."This is not a legal lecture; it is a tactical retrospective for technical leaders and directors. We will map these specific regulatory failures directly to the ASD 2025-26 Board Priorities, providing a clear path to compliance.Attendees will leave with:A "Cheat Sheet" for the Board: Connecting specific court findings (e.g., legacy IT negligence) to budget line items.The "Sin Bin" Strategy: Understanding why the "Operational Debt" of mandatory audits (Vinomofo) can be more damaging than a fine, and how to avoid it.M&A Gatekeeping: A framework for due diligence that treats acquired networks as hostile territory until proven otherwise.In this arena, the stakes are real. This presentation gives defenders the rulebook they need to stay on the field.
Lesley Carhart - Building Your First Operational Technology (OT) Incident Response Plan AUSCERT 2026-06-18 | Over the last several years, awareness of cyber threats facing Operational Technology (OT) environments have grown in both governments and business. Asset owners and cybersecurity administrators have been impacted by critical infrastructure cybersecurity regulation, whilst case studies of intrusions into these environments have become more common and concerning. However, dealing with these environments poses unique challenges, and responding to intrusions in them from criminals, insiders, and states requires special handling and preparation. This lecture will address the basics of building an OT-specific Incident Response Plan or Playbook. Attendees will learn foundational differences between an IT plan and and OT plan and why they are noteworthy. They will gain skills and ideas for dealing with the unique technical and human situations which exist in these process environments. They will leave this lecture with essential tools to start constructing or improving their OT Incident Response plan.
Daniel McNamara - Achievement Unlocked: Two Decades of Phishing Research AUSCERT 2026-06-18 | Phishing: the end boss that refuses to die. Twenty years in, the mechanics are familiar, the guides are plentiful, yet the raid keeps wiping.In this talk, phishing is framed as a series of World of Warcraft raids. Early phases taught us to spot the obvious, building confidence in warnings, filters, and training. Then each “expansion” arrived: brand impersonation, mobile phishing, MFA fatigue, QR codes, and AI-generated lures. Every tactic we thought worked punished us again.The speaker brings a double grind: two decades of phishing research and two decades of far too much World of Warcraft. Using raid encounters as a lens, the talk explores why phishing resists one-shot victories and why real progress depends on learning, adaptation, and designing systems that survive inevitable wipes.
Ty Miller - The AI Cyber Arms Race Has Begun AUSCERT 2026-06-18 | For years, organisations built cyber security strategies around human attackers and human defenders.Human analysts.Human response times.Human investigation capacity.Human operational scale.That model is now completely broken.In the wake of Claude Mythos, Boards, Executives, and Security Teams have finally seen the reality that advanced AI-driven attacks are upon us. Threat actors are no longer constrained by human speed, human creativity, or human operational limits.AI-generated attacks are now dynamic, adaptive, scalable, and operating at machine speed.Exploits can be automatically generated, tuned, modified, and weaponised faster than human teams can realistically defend against them.This creates a fundamental imbalance. The outcome is inevitable.Human-speed defence strategies will not keep pace with the next generation of AI-powered threats.This is not simply a tooling problem.It is a complete operating model overhaul.To survive the next wave of attacks, organisations will need to fundamentally reinvent their entire security strategy, including:• How AI-driven attacks will evolve over the next 6, 12, and 24 months• What an AI-capable cyber security strategy actually looks like• How to operationalise AI-powered defence across the organisation — and quickly• What happens if organisations fail to adapt fast enoughIn this presentation, you will learn how organisations can reinvent and operationalise AI-powered cyber security capabilities to survive the next generation of threats.The future of cyber security is not humans versus AI.It is AI-powered defenders operating alongside humans at machine speed.You need to fight AI with AI.You need to imagine a limitless cyber security team.
Adam Selwood - Co-op Mode: Levelling Up Supply Chain Resilience AUSCERT 2026-06-18 | In the current landscape of cyber defence, enterprise teams are investing in advanced capabilities (XDR, SOAR, and threat intel) while their suppliers often struggle with the basics. The traditional approach of throwing rigid compliance questionnaires at these smaller players creates a compliance versus reality gap. It generates administrative fatigue rather than actual operational readiness, leaving the supply chain vulnerable to attacks.Drawing on ground-truth data from over 2,000 Australian engagements, this session presents a strategy to move beyond the adversarial dynamic of compliance to a co-op model. We'll demonstrate how assessors and security leaders can identify critical suppliers and apply practical strategies to level up their cyber maturity. This session provides a playbook for trading static questionnaires for shared resilience, improving collective visibility, and ensuring your partners are ready to respond when it counts.
Gaining a Cognitive Edge: Smart Esports (AI and Cyber) for High Performance Team Training AUSCERT 2026-06-18 | Esports is redefining the concept of an "athlete," shifting the focus beyond the physical to what we call the "cognitive athlete." This new archetype excels in crucial areas like rapid reaction time, predictive modeling, and flawless strategic execution in high-stakes, pressure-filled environments. This intense cognitive conditioning is now shaping the future of digital defense to be AI-ready in a world increasingly moving from traditional networks to cognitive infrastructures and networks. This intense cognitive conditioning is fundamentally reshaping the future of digital defense, preparing it for an AI-centric world. This transition is crucial as traditional networks evolve into cognitive infrastructures requiring cognitive security strategies.Join this high-energy session to explore how cyber esports transforms security teams into high-performers. We argue that high-pressure cyber simulations cultivate essential core skills by connecting directly to elevated professional performance. We'll examine cognitive conditioning through gaming to blend implicit and explicit learning, drawing on insights from famous sports coaches for competitive advantage beyond the game. We’ll share research supporting the link between high-level gaming and superior cognitive function (reaction time, decision speed, confidence, attention, and strategic planning).Cyber esports uniquely fosters critical non-technical skills—problem-solving, critical thinking, teamwork, data analysis, and leadership—which the World Economic Forum highlights as crucial skill gaps. Simulating realistic cyber scenarios through "cognitive conditioning" directly prepares individuals for high-stakes environments like SOCs.Cognitive conditioning (applied learning) builds intuition and instinct for better problem-solving and expedited decision-making. We will show how "playing" in cybersecurity and AI games translates into more effective "working," exploring new security operational requirements in cognitive security.We will discuss how lifelong engagement with games and CTFs strengthens neural pathways, leading to measurable improvements in individual and team performance and ultimately productivity. The session will conclude with practical strategies for integrating games into the corporate environment to boost growth and morale.
