Why Australian CISOs are buying less technology and demanding more operational outcomes

The Australian cyber market has moved past the assumption that more technology equals more control.

CISOs still need stronger capability across AI, identity, cloud, data protection and resilience.

What has changed is their tolerance for tools that add operational drag: another dashboard, another handoff, another approval path, another evidence source to reconcile before leaders can act.

ADAPT’s Security Edge last May 2026 showed a market becoming more selective about what earns attention, budget and executive support.

Products that add complexity to already stretched environments face heavier scrutiny because buyers are already carrying too much operational weight across teams, controls, data, risk and reporting.

ADAPT research shows 75% of Australian organisations are exploring or actively pursuing security tool consolidation.

Consolidation is a clear commercial signal: buyers are examining whether each solution makes security easier to run, easier to govern and easier to explain across the organisation.

Product capability now has to be explained through organisational effect: which decisions become faster, which handoffs disappear, which teams gain visibility and which risks become easier to evidence.

Buyers reward operational simplicity

Security leaders are simplifying their estates because complexity has become an operating risk.

Too many tools create too many dashboards, integration points, escalation paths and ownership gaps.

The challenge is whether the organisation can absorb, govern and act on each capability quickly enough to justify the investment.

William MacMillan, Chief Product Officer of Andesite and former CISO at the CIA and former SVP of InfoSec at Salesforce argued that AI is already strong at observation, orientation, triage and analyst workflow support, but enterprise value diminishes once work has to move across organisational boundaries.

His vulnerability management example is one of the clearest signals for security buying: the CISO team may identify the exposure, the CIO organisation may own patching, and the delay sits between those functions.

He also argued that CISOs and CDOs should operate closely because cyber security is increasingly a data discipline.

Enterprise buyers are placing more value on technologies that shorten the path from signal to ownership, action and evidence.

Detection remains critical, but its enterprise value is capped when remediation gets stuck between teams.

If ownership is unclear, handoffs are slow or CISO and CIO workflows are disconnected, the organisation can see risk faster than it can reduce it.

Stronger platforms connect the work around the alert: who owns it, what needs to happen first, what evidence is created and how the task moves across security, technology and risk teams without creating another coordination burden.

Feature depth only becomes commercially useful when it shortens the path between detection, ownership, action and evidence.

Security buyers are looking for fewer handoffs, clearer accountability, faster decisions and less effort required from already stretched teams.

Operational simplicity now has measurable commercial value because it reduces the management cost of security.

The standout offerings make the security function easier to operate across the enterprise, rather than more impressive inside one team.

Back to top

AI governance has become product evaluation

ADAPT research shows 77% of Australian CISOs are investing in AI governance in 2026.

That investment changes how AI-enabled products are evaluated.

Buyers are assessing whether each platform can be governed inside real workflows, with clear identity controls, data boundaries, approval points, evidence trails and auditability.

Buyers increasingly evaluate:

• which identities can access AI-enabled functions
• what data the platform uses, stores or exposes
• how agent actions are permissioned
• where human approval sits in the workflow
• what evidence is created for audit, reporting and review
• how the product supports policy with minimal user friction

William’s “human at the helm” model gives this buying test a clear boundary.

He separated AI’s strength in observe and orient work from higher-consequence decide and act stages, where human authority and role-based access controls matter.

His concept of “evidentiary AI” demands that every AI-supported action leaves a record humans can review, challenge and explain to executives, regulators and auditors.

Keyur Lavingia, Head of Cyber Security at Village Roadshow, showed what practical AI governance can look like inside a real business.

Village Roadshow created a traffic light model for AI tools, with green, amber and red classifications shaped by business, legal and technology input.

The framework gives employees a simple user experience while controlling upload, download and access behaviour based on approved use.

Keyur’s broader point was that AI adoption scales when people can experiment within visible, agreed guardrails.

Governance is becoming product differentiation because buyers are measuring how easily a platform fits into identity, logging, approval, evidence and risk workflows.

Products that require buyers to design governance after deployment are creating unpaid work for security, legal, data and risk teams. That work now affects adoption speed, budget confidence and renewal risk.

The strongest AI propositions treat governance as part of the product experience.

Controls need to be visible to security teams, usable for employees and defensible to executives.

If governance creates too much extra work around the platform, enterprise scale becomes harder to achieve.

Back to top

Security teams now reward enablement

Security leaders at Security Edge repeatedly described cyber as a function that helps the organisation move with confidence.

CISOs need technologies that let them shape business decisions early, offer safer paths and reduce the conditions that drive shadow behaviour.

Darren Kane, Chief Security Officer at NBN, described security as a provider of confidence for the business: visibility, control and the ability to slow or stop risk when required while allowing the organisation to operate at speed.

Sam Fariborz, CISO at David Jones, described security through business context, risk appetite and simple principles that teams can use before formal review.

Mark Alexander, CISO at ASD, reinforced the need for frictionless governance, practical conversations and real usage visibility so people engage security early.

CISOs already know risk exists and they’re prioritising how to help the business adopt AI, cloud, data platforms and automation without creating unmanaged exposure.

Products that only amplify fear give buyers limited internal leverage.

On the other hand, products that make safe adoption easier help the CISO become a practical partner to the business.

Commercial value increasingly comes from reducing the moments where business teams feel forced to bypass security to keep moving.

Faster onboarding, cleaner data handling, lower approval burden, better cross-functional visibility and stronger executive confidence now matter as much as technical control.

A product becomes more valuable when it helps the CISO approve change with control already built into the path.

That is where enablement becomes a buying criterion: the ability to help the business move faster without pushing risk into blind spots.

Back to top

Resilience has moved beyond enterprise IT

ADAPT research shows 44% of Australian organisations have operational technology environments requiring significant or business-critical cybersecurity oversight.

Many market messages still describe resilience through enterprise IT control language, while buyers with OT or critical operations are thinking about service interruption, safety, recovery windows, regulatory exposure and customer consequence.

Darren’s comments on NBN brought this into focus.

In a critical infrastructure context, new technology has to be evaluated through service continuity, response and recovery because disruption has national consequence.

Mark added that AI adoption creates risks around data sovereignty, compartmentation, access and misuse, requiring visibility into how AI is used and what information flows through it.

Village Roadshow adds another useful lens. Keyur described three different business models across cinemas, theme parks and film distribution, each with different customer journeys, operational rhythms and data needs.

Cinema attendance can be spontaneous, theme park visits are planned further in advance, and film distribution operates through another model again.

A single security message misses those differences because each environment carries a different consequence profile.

The buyer’s operating model now matters as much as the buyer’s industry.

OT-heavy environments, customer-facing businesses, critical infrastructure operators and digital-first enterprises assess risk through different consequences.

A product that sounds compelling to a corporate IT team may fail to land with a resilience buyer protecting physical operations or customer-facing services.

Stronger positioning reflects the environment being protected, the continuity expectations attached to it and the decisions leaders need to make when disruption hits.

The closer a security proposition gets to the buyer’s operating reality, the easier it becomes to justify internally.

Back to top

Buyers now expect proof

High-profile breaches have made buyers more evidence-driven.

Capability claims need proof, assurance and visibility that can withstand executive, board, regulator and customer scrutiny.

Confidence is now built through what can be tested, evidenced and explained.

Alex Loizou, Cyber Security Leader at Intrinsic Security, made this point through his experience during the Medibank incident.

Alex described recovery as a long effort across immediate remediation and deeper structural change, with trust rebuilt through assurance, testing and repeated proof.

Organisations preparing for or recovering from major incidents need evidence at every step. They need to show what changed, why it matters and how they know it works.

Jamie Rossato, CISO at Orica Australia, connected that evidence requirement to executive and board engagement.

He argued that cyber investment is secured with executive management before it reaches the board, and that leaders need to show control effectiveness, value for money, unresolved risk and future readiness in business language.

His threat-led approach shows why buyers respond to capabilities tied to real exposure and operational consequence.

Proof now needs to appear earlier in the buying conversation.

Buyers need evidence of:

• measurable reduction in operational complexity
• clearer control performance
• faster response or remediation workflows
• stronger auditability and reporting
• visibility across users, data, systems and third parties
• resilience outcomes executives can understand

Confidence becomes commercial when the buyer can defend the decision internally: why this vendor, why this investment, why now and what risk changes as a result.

The strongest sales conversation gives the buyer language they can reuse with management: which risk changes, which control improves, which cost is avoided, which operational dependency is reduced and which future exposure is easier to govern.

Product demonstrations prove what the technology can do.

Stronger commercial cases prove why the buyer should act: which risk changes, which burden reduces, and which executive decision becomes easier to defend.

Back to top