A trusted future relies on effectively managing third-party dependencies within critical infrastructure operations, many of which remain unseen and underestimated.

To ensure resilience, we must take a comprehensive approach to security, spanning physical, cyber, supply chain, and personnel risks.

In this roundtable, we will explore:

• The current state of Critical Infrastructure and its evolving security landscape.
• The critical impact of third-party risks, highlighting sector-specific examples and the importance of a robust risk management framework.
• Strategies to prioritise supplier diversification, including the role of sovereign suppliers in enhancing national security.

As nationally significant operators, Critical Infrastructure providers must cultivate strong local partnerships with vendors, service providers, and industry leaders to build a more secure and resilient future.

Agentic AI is no longer experimental, it’s rapidly becoming a new operational layer within government, with autonomous agents increasingly tasked with decisions, coordination, and interaction across digital services. From cybersecurity to service delivery, these agents introduce new opportunities for efficiency, but also introduce a new identity class that is persistent, intelligent, and capable of autonomous action, with one critical question: Are we ready? Ready not just to adopt Agentic AI, but to govern it securely, especially as most agencies are still grappling with foundational challenges across human, third-party, and machine identity. How can we safely embrace these emerging technologies unless we first ensure the basics are covered? And how do we extend identity and access governance to include autonomous agents?

What We’ll Explore:

• What is Agentic AI? - How it differs from traditional automation and why it represents a new class of digital actor.
• Why Readiness Matter - The shift toward Agentic AI demands more than enthusiasm—it requires governance, security, and identity maturity.
• Where the Risks Lie - From hallucinations and misaligned actions to adversarial manipulation and uncontrolled sprawl—what happens when agents go rogue?
• Securing the Foundation First Before expanding into new identity classes, how well are we securing existing workforce, third-party, and machine identities?
• Governance Models for Agentic AI - How can public sector agencies build frameworks that account for intent, explainability, access control, and lifecycle management?
• What It Takes to Be Ready - Discussion on practical steps to assess organisational readiness, close security gaps, and responsibly adopt agent-based systems.

• Explore opportunities to prepare for incidents before they happen. What does good incident response look like?
• Discuss key insights gleaned from more than 500 significant cyber compromise event responses across the nation in the past year
• The most dangerous threats are coordinated and synchronised. What should be on your Cyber checklist for 2025?

The recently legislated Privacy and Responsible Information Sharing (PRIS) Act has introduced a wide sweeping set of new and changing obligations for State Government entities, and their associated service providers. The new legislation requires meaningful changes to the ways organisations operate and, in some cases, the introduction of new processes entirely that require organisational adaption to suit.

This roundtable discussion will focus on the new Privacy and Responsible Information Sharing (PRIS) Act and its implications for WA Government organisations. It will also offer up practical guidance on ways to comply with the new requirements and discuss shared learnings across participants.

As governments increasingly turn to cloud and Software-as-a-Service (SaaS) platforms, the risks associated with suppliers become more complex and interconnected. Traditional procurement risk frameworks often struggle to account for issues such as shared infrastructure, multi-tenant environments, and rapid vendor scaling. This creates new challenges for ensuring resilience, security, and compliance in critical public sector services.

Evaluating supplier risks requires going beyond basic financial and contractual checks. Governments must assess vendor security practices, data handling processes, and resilience planning, while also considering factors such as vendor lock-in, concentration risk, and geopolitical influences. Independent certifications and audits can help, but they rarely provide the full picture of operational dependencies and long-term stability.

Mitigation strategies should therefore blend technical, contractual, and governance measures. This may include diversification of suppliers, stronger exit and portability clauses, ongoing monitoring of supplier performance, and alignment with state & national cybersecurity and data sovereignty requirements. By adopting a more proactive and holistic approach, governments can better balance the benefits of cloud and SaaS innovation with the duty to manage supplier risk responsibly

In today’s increasingly digital and interconnected healthcare environment, managing vulnerabilities is no longer solely the responsibility of IT or cybersecurity teams.

Effective vulnerability management requires cohesive collaboration between various stakeholders.

This roundtable discussion aims to explore the challenges, best practices, and opportunities for fostering effective communication and coordination in addressing security risks.

Participants will discuss real-world scenarios, examine the role of organisational culture and leadership, and identify tools and processes for effective vulnerability management

Identity is the only common denominator between all users, applications they have access to, and the type of access they have. This is why Identity must be treated as a strategic pillar to reduce agency risk by shrinking the attack surface, reduce technical debt, reduce operational expenditure, and improve experiences holistically.

• Seamless, Cross-Platform Access: Enable frictionless login and authentication across any device, integrating effortlessly with existing Microsoft and other third-party products.
• Built-in Compliance: Meet and exceed all relevant compliance requirements with a best-of-breed identity solution such as the Essential Eight Maturity Level 3.
• Simplified Management and ROI: Achieve easier implementation and maintenance, ensuring a strong return on investment.