In this Security Edge panel, security leaders from healthcare, retail, education, and technology revealed the top risks and priorities before 2026.

Jason Murrell, renowned cyber security advocate and consultant, Emily Mailes, Chief eHealth Strategy Officer at the Victorian Department of Health, Samrat Seal, Head of Transformation and Governance at Kmart Group, Peter Wolski, General Manager of Reliability and Security at MYOB, and Tara Dharnikota, Chief Information Security Officer at Victoria University, discussed the realities of ransomware, human risk, and regulatory pressure shaping Australia’s security landscape.

Ransomware remains one of the most persistent and costly threats, with healthcare among the hardest hit.

In Victoria, 15% of public hospitals went offline during one of Australia’s largest ransomware incidents, taking months to recover.

Despite this, readiness varies widely across the state’s 70 health organisations, where ICT and security teams may operate collaboratively or in silos.

Panellists agreed that tested backups, asset visibility, and network segmentation are still the most effective defences.

They noted how attackers now use ransomware-as-a-service models, professional negotiation tactics, and dual extortion methods prioritising data theft and public exposure over simple system lockdowns.

Across sectors like higher education and retail, resilience and recovery planning are now valued as much as prevention.

Regular tabletop exercises involving boards and senior executives are critical to strengthening communication and decision-making under pressure.

Human behaviour remains a major weakness, with studies showing 60% of employees knowingly bypass cyber policies when they hinder productivity, particularly in hospitals.

Many organisations are embracing security by default, reducing reliance on individuals through automated controls like multi-factor authentication (MFA) and embedded guardrails.

However, MFA adoption remains uneven, as retail balances strong authentication with customer experience and universities face cultural resistance.

Regulatory and third-party risks are growing.

Frameworks such as APRA CPS 230 are tightening operational and supply chain resilience standards, prompting organisations to reassess third-, fourth-, and fifth-party dependencies.

Leaders are refreshing risk frameworks, implementing AI-driven continuous monitoring, and adopting Software Bill of Materials (SBOMs) for greater transparency.

As ADAPT data shows, most organisations rate themselves below five out of ten in using or defending against AI-driven attacks, exposing a maturity gap despite years of exposure to AI in cyber security tools.

The panellists warned that compliance alone does not equal resilience, since many suppliers self-attest to security posture.

Instead, organisations must plan for failure, maintain tested supplier outage playbooks, and treat cyber resilience as a shared responsibility.

As one participant concluded, resilience depends on a shared fate mindset, where organisations and vendors rise and fall together in today’s interconnected landscape.

 

Key takeaways

  • Ransomware readiness drives resilience: Victorian healthcare remains a major target, with 15% of public hospitals taken offline in a single attack. Uneven preparedness across 70 health organisations highlights the need for tested backups, network segmentation, and stronger ICT–security collaboration.
  • Human behaviour is the critical weakness: Around 60% of employees knowingly bypass cyber policies for convenience, prompting a shift to automated, security-by-default measures such as MFA and embedded system safeguards. Cultural and usability barriers still limit full adoption.
  • Compliance does not equal resilience: With APRA CPS 230 enforcing tougher standards, organisations are investing in AI-driven monitoring, refreshed third-party frameworks, and SBOMs for transparency. True resilience requires tested incident playbooks and a shared fate approach across supply chains.
Contributors
Jason Murrell Renowned Cyber Security Advocate and Consultant
With over 20 years of experience in start-ups and the broader technology industry, I am a renowned advocate for cyber security in... More

With over 20 years of experience in start-ups and the broader technology industry, I am a renowned advocate for cyber security in Australia. My journey has been marked by fostering collaboration and propelling the growth of Australia’s cyber security industry.

Key Achievements:

  • Developed strategic initiatives and partnerships that fuel innovation in collaboration with start-ups, industry leaders, government agencies and academia.
  • Recognised thought leader, sharing insights on entrepreneurship, cyber security and public-private sector collaboration.
  • Featured in reputable media outlets, amplifying the significance of cyber security in today’s digital landscape.

I am committed to driving innovation and resilience in the field, leveraging my expertise to align strategies with industry needs and address evolving cyber threats. My role at AustCyber involved close collaboration with various stakeholders to develop strategic initiatives and forge partnerships that fuel innovation.

Less
Tara Dharnikota CISO at Victoria University
Tara is the Chief Information Security Officer at Victoria University, responsible for cyber and physical security, risk and assurance and business resilience.... More

Tara is the Chief Information Security Officer at Victoria University, responsible for cyber and physical security, risk and assurance and business resilience.

With a foundation in network engineering and extensive experience across security, she has worked across diverse sectors including financial services, telecommunications, e-conveyancing and higher education, leading high-performing teams across threat intelligence, offensive security, strategy, risk and governance and security culture. Her career spans senior leadership roles in highly regulated industries, notably at PEXA and Telstra.

Tara also contributes as an advisor to national security forums and higher education institutions and serves on the Victorian Committee for the Australian Information Security Association (AISA).

She is passionate about empowering people, fostering inclusive and secure environments and embedding resilience at the heart of organisational strategy.

Less
Samrat Seal Head of Transformation and Governance at Kmart Group
A technology strategy thought leader with a legacy of shaping and delivering high-stakes digital transformations, Samrat is known for leading from the... More

A technology strategy thought leader with a legacy of shaping and delivering high-stakes digital transformations, Samrat is known for leading from the front—where innovation, security, and business value converge. With a sharp strategic lens and deep domain expertise, he has successfully built and managed complex portfolios across cross-section of business, while delivering enterprise-wide transformation initiatives, with end-to-end P&L ownership and NorthStar commercial acumen.

Samrat brings an unique combination of strategic clarity, technical depth, and business-first mindset to every engagement—driving change at scale, mitigating risk, and unlocking long-term value for stakeholders. He is adept at navigating ambiguity and aligning technology investments with business outcomes, while ensuring agility, regulatory compliance, and secure-by-design principles remain at the core of delivery.

A proven people leader, Samrat has built and led high-performing, cross-functional teams across geographies—fostering collaboration, ownership, and continuous innovation. His leadership approach empowers talent, nurtures future leaders, and builds a culture of excellence, accountability, and resilience.

With a strong foundation across cybersecurity, AI, cloud computing, API ecosystems, and over-arching digital transformation, Samrat is committed to advancing enterprise capabilities through secure, scalable, and future-ready platforms. He is passionate about shaping the next frontier of technology, translating vision into execution, and delivering measurable business impact in an ever-evolving digital landscape.

Less
Peter Wolski General Manager of Reliability and Security at MYOB
Peter Wolski is the General Manager Reliability and Security at MYOB. With a career spanning over two decades in the technology and... More

Peter Wolski is the General Manager Reliability and Security at MYOB. With a career spanning over two decades in the technology and finance industry, Peter has established himself as a strategic leader with a knack for driving operational efficiency and implementing innovative solutions.

Peter joined MYOB in 2020, bringing with him a wealth of experience from his previous roles in various multinational corporations. At MYOB, he has been instrumental in leading the company’s digital transformation efforts, streamlining processes, and enhancing customer experience.

Less
Emily Mailes Chief eHealth Strategy Officer at VIC Department of Health
As the Chief eHealth Strategy Officer at the Department of Health in Victoria, my role encompasses two core areas: driving digital strategy... More

As the Chief eHealth Strategy Officer at the Department of Health in Victoria, my role encompasses two core areas: driving digital strategy for the future of healthcare and ensuring the cybersecurity and operational integrity of critical health systems.

On the digital strategy side, I am responsible for setting an ambitious agenda that shapes the future of the Victorian health system through innovation and transformation. By collaborating with policymakers, funders, and healthcare leaders, I work to align strategic initiatives and emerging technologies that drive improvements across the system and enhance the health and wellbeing of Victorians.

In parallel, I oversee a 24/7 cybersecurity operation dedicated to protecting Victorians’ health data and securing the critical systems that keep our healthcare services running. My leadership in cybersecurity is focused on ensuring robust protections against emerging threats while maintaining operational excellence in the face of evolving challenges.

My dual role allows me to balance high-level strategic vision with the practical, day-to-day oversight of security operations, ensuring both the future and the present of the health system are secure, resilient, and forward-thinking.

Less
compliance security leadership