A trusted future relies on effectively managing third-party dependencies within critical infrastructure operations, many of which remain unseen and underestimated.

To ensure resilience, we must take a comprehensive approach to security, spanning physical, cyber, supply chain, and personnel risks.

In this roundtable, we will explore:

• The current state of Critical Infrastructure and its evolving security landscape.
• The critical impact of third-party risks, highlighting sector-specific examples and the importance of a robust risk management framework.
• Strategies to prioritise supplier diversification, including the role of sovereign suppliers in enhancing national security.

As nationally significant operators, Critical Infrastructure providers must cultivate strong local partnerships with vendors, service providers, and industry leaders to build a more secure and resilient future.

• Engage with real-world challenges – Cyber-attacks on Federal agencies are increasing. How prepared is your organisation?
• Vote and debate – Share your stance on key cybersecurity issues and discuss solutions with peers.
• Turn insights into action – Explore AI-driven security and best practices to strengthen cyber resilience in your agency.
• What "Proactive Cybersecurity" measures do you take now?
• How well do you believe you are progressing to meet the 2023-2030 Australian Cyber Security Strategy from Home Affairs
• Could you show your Deputy Secretary/Minister a Cyber risk score across your organisation?

Non-Human Identities and automated systems are rapidly transforming public sector operations. However, as AI agents begin to initiate actions, make decisions and access sensitive data across government systems, the traditional concept of identity is no longer limited to people. This roundtable will explore how agencies can maintain accountability, transparency and control in an environment where both humans and machines are operating at speed and scale.

Discussion Themes

• How can agencies maintain clear lines of accountability as automated decision-making increases across programs and service delivery
• Do you have full visibility of who or what has access to your critical systems and data today
• Should AI agents be governed as identities with roles, attributes and permissions similar to human users
• How can explainability and auditability be embedded into AI enabled processes for compliance and assurance
• What safeguards are required before granting AI agents access to sensitive information or privileged actions
• What capability uplift will be required across the APS to govern machine scale access and identity risk
• Looking ahead to 2030 what does trusted automation and secure identity assurance look like across the Australian Government

• Unpack the 2025 Protective Security Policy Framework (PSPF) updates and what they mean for federal, state, and territory agencies.
• Explore new PSPF guidance on managing AI and other risks, adopting Zero Trust security, and preparing for quantum threats.
• Gain insights into potential government cyber security priorities, and changes under Horizon 2 of the Cyber Security Strategy.

As government agencies and firms providing software to the government agencies accelerate their adoption of cloud-native architectures and open source components, traditional compliance and assurance models are struggling to keep pace with modern software delivery.

In this roundtable, we will explore how to modernise regulatory guardrails to meet the realities of continuous delivery, open source dependencies, and cyber resilience, and how we can ensure that rules truly raise the security floor for both organisations and citizens.

Key Topics to Be Covered:

• Why it’s critical to account for cloud-native, DevSecOps paradigms
• Integrating supply chain security (SBOMs, provenance, cryptographic integrity) into compliance
• Balancing prescriptiveness vs flexibility in government security policy
• Measuring real security impact—how do we know regulation is making us safer?

Australia’s new Cyber Security Act 2024 and updated SOCI Act have raised the stakes for government agencies, with penalties of up to $50 million for non-compliance. Traditional defence-only strategies are no longer sufficient—federal agencies must shift to “breach-ready” architectures that ensure continuity of critical services during an attack.

This closed-door roundtable will explore how agencies can bridge the gap between policy frameworks and operational resilience. Participants will engage with an evidence-based approach to legislative compliance, risk reduction, and business continuity planning that leverages existing investments rather than requiring full infrastructure replacement.

Discussion Focus

• Meeting new compliance requirements with confidence
• Why EDR, NDR, and firewalls alone won’t keep services running
• Designing breach-ready architectures for minimum viability and rapid recovery
• Resource planning and implementation strategies

Key Benefits

Gain a clear roadmap to compliance, methodologies to maintain uptime during cyber incidents, strategies to minimise penalties and data risk, and cost-effective pathways to resilience.

AI is now a weapon in the hands of bad actors—creating self-morphing malware, automating breaches, and outpacing legacy defences. This session will show you how to embed AI in your security posture so you can stay ahead of evolving threats, protect exposed APIs, and boost resilience with limited resources.

• Explore how AI is being weaponised to evade traditional government cyber defences
• Unpack why AI adoption remains low despite rising threat levels
• Identify where your third-party APIs are most vulnerable to exploitation
• Discover how AI can offset the growing cyber skills shortage
• Learn how to integrate AI into your detection and response architecture

Everyone is worried about the front door. We’re worried about the back door. Because building cyber resilience across Australia doesn’t end when a device is retired. Cybersecurity matters from start to finish - so how are the nation’s governments, and enterprises addressing end of life cyber vulnerabilities in devices?And are we doing it right?

We’ll explore:

• The hidden risks in your end-of-life ICT equipment - who is left exposed, non-compliant, and vulnerable to attack.
• How do the right strategies on end-of-life decommissioning/disposal impact overarching government goals
  • ESG – Scope 3, Circularity, Sustainability
  • Reconciliation Action Plans
  • Indigenous Procurement