Settle in, grab a coffee, and meet a few friendly faces before we begin.

A short welcome, plus a few quick tips to help you connect, share, and get real value from the day. We’ll also run a couple of quick polls to see what everyone’s interested in and what people are working on right now.

A short briefing from the Chair to get everyone aligned, comfortable, and ready for a great day of ideas and connection.

As Queensland continues to implement its Cyber Security Strategy, attention is shifting from policy and planning to delivery across government systems, services and infrastructure. This session will explore how agencies are progressing key initiatives, strengthening coordination across government, and embedding cyber security into digital service delivery. It will highlight early progress, emerging lessons and how Queensland can sustain momentum as cyber threats continue to evolve.

• Strengthening whole-of-government coordination to accelerate cyber maturity across agencies
• Progress and lessons emerging from early implementation of Queensland’s cyber priorities
• Embedding cyber security into the design and delivery of digital government services
• Sustaining momentum and capability as Queensland prepares for an increasingly complex cyber environment

The government security perimeter has changed. People no longer work from a single office. Agencies rely on contractors, partners, cloud platforms, SaaS applications, legacy systems and increasingly, AI. Access can come from anywhere, at any time, and through identities that are human, privileged, third-party or machine based.

In this environment, identity has become the new perimeter. But what does identity security actually mean, and why has it become such a critical part of cyber resilience?

This keynote provides a practical introduction to identity security and explores how government organisations can reduce risk by understanding who has access, what they can access, and whether they should still have that access.

We’ll unpack the fundamentals of identity security, including:

• Why compromised and misused identities are such a powerful pathway for attackers
• The difference between authentication, access management and identity security
• What least privilege and zero trust really mean in practice
• The hidden identity risks created by contractors, third parties, privileged accounts and machine identities
• Why visibility and continuous access governance matter
• How agencies can strengthen security without creating unnecessary friction for users
• Practical first steps for building a stronger identity security foundation

The message is simple: in a borderless government, securing the network is no longer enough. We need to secure the identities that move through it.

As agencies depend on more SaaS platforms, managed providers and digital partners, supply chain cyber security now relies on shared resilience, not just stronger contracts or controls. This session explores how public sector organisations and their vendors can prepare for disruption, clarify responsibilities and work together when a third-party incident affects critical services.

• Strengthen resilience across critical vendors, platforms and managed service partners.
• Move beyond traditional assurance, including ISO certification, SOC 2 reports and contract clauses.
• Clarify shared responsibilities across SaaS, cloud and outsourced service models.
• Plan for longer outages, limited visibility and unclear escalation paths.
• Use trusted networks, sector collaboration and vendor partnerships to support response and recovery.

Artificial intelligence is transforming the way government operates, innovates and builds trust. It is also reshaping the cyber threat landscape. Cybercriminals are using AI to automate attacks, craft convincing phishing campaigns, evade traditional security controls, and accelerate the speed and scale of compromise. As AI adoption grows across government and critical infrastructure, legacy security frameworks are struggling to keep pace. This session explores how agencies can modernise their cyber guardrails for an AI-driven threat environment. It examines the risks of generative AI, autonomous attack techniques and increasingly sophisticated adversaries, and shares practical strategies to strengthen resilience.

Perfect time to swap notes and compare what’s working across teams and sectors

MNDB is now one year in and has recently been extended to local government, with agencies beginning to see its real-world impact. While the framework itself is clear, applying it in practice is proving more complex—particularly when it comes to assessing breaches, determining what constitutes “serious harm,” and coordinating effective responses. These challenges are reshaping how agencies approach breach management and accountability, while driving more consistent and coordinated decision-making during incidents.

• Applying MNDB in practice: assessing breaches and determining “serious harm”
• Strengthening breach response, incident management and coordinated decision-making
• Embedding risk assessment and secure-by-design to build resilient digital services
• Enhancing whole-of-government collaboration to strengthen resilience and maintain public trust

As cyber threats continue to evolve, organisations are recognising that resilience extends beyond technology alone. Many of the greatest risks, and opportunities, sit within people, behaviours and organisational culture. This discussion will explore how trust, leadership and accountability can strengthen cyber resilience, while balancing secure systems with the usability needed to deliver effective digital services. .

• Moving beyond a technology-first mindset: why tools alone cannot mitigate cyber risk
• Understanding human behaviour as a core driver of vulnerability and resilience
• Embedding a culture of security through education, accountability and leadership
• Balancing trust, usability and safeguarding in the delivery of digital services

As quantum computing accelerates, the security foundations that underpin today’s digital government are being fundamentally challenged. With a national shift towards post-quantum cryptography mandated by 2030, government agencies must begin preparing now to ensure sensitive data, critical infrastructure and citizen services remain secure in the decades ahead.

• What the 2030 post-quantum mandate means for government policy, systems and long-term data security
• Identifying cryptographic risk across legacy systems, infrastructure and supply chains
• Preparing for “harvest now, decrypt later” threats and protecting sensitive data over time
• Embedding cryptographic agility into digital infrastructure, procurement and transformation programs
• Building a practical roadmap for transitioning to quantum-safe encryption across government

Grab lunch, have a wander, and chat with industry partners and peers about practical ideas you can take back to work. Arguably the most important part of the day!

Successful AI adoption requires more than technology and policy. It depends on effective governance, a collaborative operating model and an AI-literate workforce. Drawing on your experience enabling AI within the mining industry, the keynote will explore where cyber belongs in this model and why it must work alongside business, data and technology teams throughout delivery.

Brisbane 2032 will place Queensland’s digital services, public safety systems and critical infrastructure under global scrutiny. This session will explore how cyber security, operational planning and cross-sector coordination can support secure delivery at scale, from protecting essential services to maintaining public trust during a globally significant event.

• Strengthening cyber governance and operational readiness for Brisbane 2032
• Coordinating security across Games delivery, emergency services and critical infrastructure
• Preparing for high-impact incidents through prevention, monitoring, response and recovery planning
• Protecting public-facing systems, essential services and trusted information during a globally significant event

We’ll pull out a few highlights from the day, share what’s coming next, and point you to ways to stay connected.

Wrap up the day with good conversation and a few new connections. Thanks for making GIW your one-stop shop for benchmarking, industry updates, and great conversations.