As the security threats adapt, so must we

ambergulamali1
Jan 14
4 min read

We are witnessing one of the most rapid shifts in security in history. The security environment is everchanging. It is complex. And technology is accelerating the risk at a pace we haven’t seen before.

It’s never been more important for Australians and their businesses to take seriously the need for stronger security frameworks. Identifying where the gaps are and proactively mitigating known vulnerabilities isn’t a “nice-to-have”; it’s essential.

The risks

National Security affects us all – it’s not only a government-problem to manage. Information of any type has become so valuable to our adversaries; the worst thing a business – nay, any regular person - could do, is believe that they aren’t at risk.

The Australian Cyber Security Centre (ACSC) stated in its FY24/25 Annual Threat Report that notifications of potentially malicious cyber activity was up 83 per cent from the previous year. Not only is the number of these attacks increasing, but also the myriad ways in which they are occurring.

What are the two biggest security risks for businesses?

The “trusted insider”, which is anyone who has access to any aspect of a business (this can be systems, people, documents, equipment or premises) – such as past or current employees, contractors and visitors.
Cyber security compromises of information technology (IT) and operational technology (OT) systems.

The objectives are mixed – for some it’s state-sponsored espionage and foreign interference, for others it’s extortion and financial gain. It’s also proving a valuable way for agencies to test the security of their own systems – for example, a British cybersecurity expert was recently granted permanent residency in Australia after he identified a critical vulnerability in a Federal government system.

What can businesses do to protect themselves from security risks?

It’s not all doom and gloom – there are some really simple things businesses can do to help protect and harden themselves from potential compromise:

Assume there is always a real and ongoing threat to your business. It’s a common perception that large companies are more valuable targets, but the evidence suggests otherwise. Small and Medium Enterprises (SMEs) can often be targets due to less sophisticated system infrastructure and limited security resources. SMEs are also particularly susceptible to insider threat risks, with small and close-knit workforces allowing a (sometimes false) sense of comfort and security. Remaining vigilant, investing in regular security reviews and upgrades and keeping educated and informed on the changing threat landscape will stand you in good stead.

Build a good security culture, and make sure it’s led from the top. A sure-fire way to kill organisational culture is to not practice what you preach. Establish strong security habits amongst your leadership team, educate and equip them on the risks and what to look out for, and make it visible across the business. Normalise the integration of good security practices as the “business as usual”.

Consider the security of your own devices and infrastructure. For example, the age of your router/modem. Many people will retain the initial router provided by their service provider not realising it eventually reaches end of life and is no longer supported with security patches and firmware from the manufacturer, leaving you vulnerable to cyber-attacks. Similarly, mobile phones are increasingly the primary device for many professionals, with the lines between work and private life being blurred. When was the last time you really paid attention to the amount of information held on your phone and how you protect that information? Do you leave your phone on the table at the restaurant while your group goes up to order? Do you keep your apps and operating systems up to date with the latest updates? These are all simple things to consider to keep your personal and business information safe from adversaries, along with the new Cyber Security Rules for smart devices that take effect in March 2026 in Australia.

Get connected and get educated. There are so many organisations out there monitoring the threat landscape, providing advice and support to businesses and a wealth of information and resources. Take advantage of this and ensure you arm yourself in the event your business is compromised, such as policies, procedures, business continuity plans and so forth. Start with organisations like the Australian Security Intelligence Organisation (ASIO) and the Australian Cyber Security Centre (ACSC). If you need help reviewing your security frameworks, identifying vulnerabilities and solutions, our experienced Security professionals can help.

The bottom line

You don’t have to be a seasoned professional to implement fundamental security practices across your business; there are some really simple fundamentals of security you can implement as a SME using the resources that are publicly available. Having a trusted team to help review your security frameworks, identify your vulnerabilities and how best to mitigate them can also be invaluable. Reach out to our security professionals to discuss how we can help.

Susie Cole, Security Uplift, Business Resilience and Protective Security Lead.

Elysium EPL’s Security Uplift, Business Resilience and Protective Security Lead Susie Cole has over 25 years’ experience in security roles across Defence and the Australian Public Service. She brings a risk managed approach to complex security challenges in high security environments with unique capabilities. She approaches complex personnel security with curiosity, empathy and understanding, balancing organisational outcomes with the needs of the individual. She brings unique expertise as an Executive Security Advisor within Defence to client challenges in the Security Governance field.

Solving complex problems through an ethical, trusted and logical approach, Elysium EPL is an Australian professional services firm trusted to help clients realise their vision, and convert their ideas to lasting outcomes. Our experienced Security professionals provide support to clients across National Security, Defence and other industries to help assure your business security in an increasingly uncertain world.