CyberCon 2026
Back to Basics, Forward with AI, and Be Kind.
Last week I attended the AISA Cyber Conference in Melbourne. The program was packed, but a handful of themes kept coming up, in the keynotes, in the hallway conversations, and over coffee. Here's what stuck with me.
The basics still matter
Many presenters made the same point: cyber hygiene is as relevant a defence as it has ever been. For all the talk of emerging threats and new technology, the fundamentals remain the foundation.
The state of our industry
Conversations with other delegates revealed something I'd never have heard at conferences years ago. Plenty of people feel unfulfilled, whether from shrinking budgets or toxic work environments. The conference halls have become something of a name-and-shame list of management styles to avoid when changing jobs.
It was fitting, then, that so many talks promoted a different approach to management and collaboration, built around a simple theme: be kind. That isn't always the same as being nice, and the difference is worth thinking about.
Where the CISO sits
I spoke with a variety of CISOs, and most face the usual challenge: a CIO or CDIO motivated by goals other than cyber security, which in my opinion creates a conflict of interest. Everyone I spoke to reported "traditionally" to the CIO/CDIO.
One CISO had recently taken a different path, writing a business case to move infrastructure teams under the CISO rather than the CDIO. Their argument was that availability is one of the basic tenets of security, and if the rest of the triad (confidentiality and integrity) is to be maintained, this is the organisational structure to achieve it. It tied neatly into the conference's broader message: be kind and collaborative to achieve the organisation's goals.
Entrepreneurs and the AI gold rush
I met many entrepreneurs, who fell into two camps: those who had started a consultancy or tech business and later sold to a larger organisation, and young, bright-eyed founders just starting out. Some were official exhibitors, others I simply bumped into during breaks. Those starting out were almost exclusively talking about one thing: AI.
AI: promise, caution and a bold prediction
There's no doubt AI can improve our work, with some caveats.
The CISO of Anthropic spoke almost exclusively about AI's role in producing vulnerability-free code, and in detection and response. He put numbers on it: design for breach and put 20% on that, 70% goes to detection and response, and the remaining 10% to a two-day patch cycle for vulnerability remediation.
What surprised me was his bold, specific claim that within 18 months we will go through significant change and emerge with different roles. By then, AI will be producing vulnerability-free code, and it will be "negligent to release software with vulnerabilities."
There was plenty of discussion about AI's apparent ability to escape guardrails, though in my opinion those building the guardrails are almost entirely responsible for that. Several presenters advocated deterministic guardrails rather than relying on a model's inbuilt controls.
Jen Easterly neatly sidestepped the budget crisis CISA suffered in early 2025 and was quite optimistic about the future. Her reminder: AI today is the worst it's ever likely to be, given the current rate of development, and if you invent the ship, you invent the shipwreck along with it.
The common thread across all the predictions was that AI won't replace human creativity.
Leadership and influence
The talks I took the most from were about people rather than technology.
Adam Cunningham: speaking to the board, and contextualising risk
Adam, famous for hacking a submarine near the turn of the century, spoke more about leadership and influencing leaders than hacking anything. Perhaps he's moved on to hacking humans! His presentations are always informative and entertaining, and this was no exception. I can't do justice to his storytelling in a short summary, but three ideas stood out.
Know your three questions before you see the board. Before you go, make sure you can answer: what is it, why does anyone care, and what do we do about it? He wouldn't go near a board without the middle one. I've watered down his delivery a little; imagine him asking those same questions as the three F's.
Contextualise risk. I've known many professionals who see technical risk in binary terms. There's a patch, so it must be applied. A configuration could allow compromise, so fix it now. In some cases we're obliged to, depending on our regulatory environment. Adam's point was to ask for a demonstration: how could an attacker actually exploit this? If the attack vector isn't relevant, is it really a critical risk?
Offer choices, not ultimatums. When we hit obstacles, we tend to argue, escalate or give up. Adam suggested quietly offering choices that get everyone where they need to be. It sounded good at the time, though I'm now questioning how I'd have applied it in the past when the options were so far apart they contradicted each other. Perhaps that's my opportunity to learn more.
Tane Hunter: leading a team better
Tane, founder of Future Crunch, raised points I think I can apply to improve my team's outcomes.
Those who know me would agree I talk a lot, and when I'm the most senior person in the conversation, that narrows the range of acceptable answers. I've tried saying "please disagree if you want," but Tane suggests something more structural: reverse the speaking order, least senior first. Many of us in cyber security have imposter syndrome and may not speak at all otherwise.
His other two ideas:
- Price the default. Make people say what the old way costs before they continue doing things that way.
- Assign a devil's advocate. Deliberately appoint someone to argue against the proposal. If I ever find myself surrounded by yes-men, I'll try this one.
Takeaways
Pull it together and the message is consistent. The technical fundamentals still matter, AI will reshape our roles faster than most of us expect without replacing human creativity, and the leaders who succeed will be the ones who are kind, collaborative and willing to hear dissent.
Comments
Post a Comment