Field notes from the room.

The methodology behind our board-commissioned posture review — three instruments, one maturity model, and the charts that carry them into the boardroom.

The companies celebrating Australian AI oversight have more to gain from it than Australian organisations do.

Procurement approved it. Legal wasn't in the room. Regulators are starting to ask questions.

The gap between passing a certification review and actually being harder to compromise is wide, costly, and almost never discussed at board level. The CMMC pause is a chance to close it.

Boards that ask rigorous questions about human access entitlements are waving AI agents through as productivity decisions. That is a governance failure.

The right question is not whether your organisation is compliant. It is whether your compliance program reflects how your operation actually fails.

After two invalidated frameworks, relying on the DPF without a contingency is not legal uncertainty, it is a repeatable governance failure.

When sovereign IP law becomes a bargaining chip in foreign investment negotiations, every organisation whose assets depend on that law has skin in the game.

The Five Eyes formally confirmed AI has compressed exploitation timelines to hours. Most board-approved risk frameworks still assume weeks.

If you can't answer three questions about your cryptographic inventory, the risk is real and unmanaged

The ASD's decision to wind down the Essential Eight is not a technical update — it is an admission that prescriptive compliance models have failed. Boards should govern accordingly.

When adversaries enter through the front door, the controls that catch them are not the ones most organisations have built.

The physical reality of hyperscale compute is invisible in your contracts and absent from your risk register — but regulators are looking.

ASD's revised controls name workforce capability as a security risk. Every cost-driven delivery decision you approved is now part of that story.

Least-privilege access has been a foundational control for two decades. The question is not whether Amex knew. It is why it was not done.

Every knowledge worker now has access to capable generative tools. Almost no organisation has detection capability to match

How rapid AI adoption created a supply chain exposure that most boards have not yet named, let alone managed.

Most Australian organisations adopted open source without ever governing it. Europe's sovereignty push exposes how much that matters.

Nation-state adversaries do not wait for budget cycles. Understanding why Australia's parliamentary network needed its 'most significant' upgrade reveals a governance pattern familiar to every board room.

The gap between an algorithmic recommendation and a consequential action is where liability lives. Most AI governance frameworks are not covering it.

Reforming delivery without reforming governance is an expensive way to reproduce the same failure.

Sample sizes that mean nothing. Findings written in passive voice. PDFs sent at 4:55pm Friday.

What the next decade of certification looks like when the people writing the cheques have read the reports.