Field notes from the room.

ASD's harness guidance is the right answer for an agent you build. Most Australian organisations bought theirs, and the configuration surface it points at largely belongs to the vendor.

A 72-hour breach deadline and a right to erasure are both overdue. The erasure right is drawn by service category rather than by risk, which means it cannot reach a data broker.

A device does not have to belong to your organisation for the extraction to take your organisation's information with it.

A fake US thinktank published 560,000 words in nine days, engineered so that AI chatbots would cite it. The economics of that put it within reach of anyone with a position to advance.

A tribunal cleared Bunnings in February. Boards reading that as a green light should first check whether they are building the deployment that was cleared.

A certificate tells you an organisation met a defined standard on a defined day. Risk management tells you what happens on every other day. Boards need both, and confuse them constantly.

Australia's signals intelligence body has said what vendors won't — and executives can no longer treat ownership opacity as someone else's problem

The colour-coded matrix looks authoritative. The methodology behind it does not hold up.

A self-propagating AI worm has survived months of Microsoft's fixes. The more important question is why your organisation never formally decided how much exposure was acceptable.

When your employee is standing at a checkpoint is the wrong moment to discover your governance gap.

ASD's three-month isolation guidance exposes a continuity gap that faster detection cannot close.

The methodology behind our board-commissioned posture review — three instruments, one maturity model, and the charts that carry them into the boardroom.

The companies celebrating Australian AI oversight have more to gain from it than Australian organisations do.

Procurement approved it. Legal wasn't in the room. Regulators are starting to ask questions.

The gap between passing a certification review and actually being harder to compromise is wide, costly, and almost never discussed at board level. The CMMC pause is a chance to close it.

Boards that ask rigorous questions about human access entitlements are waving AI agents through as productivity decisions. That is a governance failure.

The right question is not whether your organisation is compliant. It is whether your compliance program reflects how your operation actually fails.

After two invalidated frameworks, relying on the DPF without a contingency is not legal uncertainty, it is a repeatable governance failure.

When sovereign IP law becomes a bargaining chip in foreign investment negotiations, every organisation whose assets depend on that law has skin in the game.

The Five Eyes formally confirmed AI has compressed exploitation timelines to hours. Most board-approved risk frameworks still assume weeks.

If you can't answer three questions about your cryptographic inventory, the risk is real and unmanaged

The ASD's decision to wind down the Essential Eight is not a technical update — it is an admission that prescriptive compliance models have failed. Boards should govern accordingly.

When adversaries enter through the front door, the controls that catch them are not the ones most organisations have built.

The physical reality of hyperscale compute is invisible in your contracts and absent from your risk register — but regulators are looking.

ASD's revised controls name workforce capability as a security risk. Every cost-driven delivery decision you approved is now part of that story.

Least-privilege access has been a foundational control for two decades. The question is not whether Amex knew. It is why it was not done.

Every knowledge worker now has access to capable generative tools. Almost no organisation has detection capability to match

How rapid AI adoption created a supply chain exposure that most boards have not yet named, let alone managed.

Most Australian organisations adopted open source without ever governing it. Europe's sovereignty push exposes how much that matters.

Nation-state adversaries do not wait for budget cycles. Understanding why Australia's parliamentary network needed its 'most significant' upgrade reveals a governance pattern familiar to every board room.

The gap between an algorithmic recommendation and a consequential action is where liability lives. Most AI governance frameworks are not covering it.