Simon H.

Despite the growing number of cybercrimes, there is still a cybersecurity skills gap in Australia. The Information Security Audit and Control Association (ISACA) reported that cybersecurity teams in Australia remain understaffed with 58% unfulfilled positions. There are still big challenges when it comes to hiring and retaining cybersecurity professionals despite the high demands. There’s also the fear of AI-technology taking over with respondents saying they use AI in security operations for threat detection, routine task automation, and endpoint security. Firms and boards should prioritize cybersecurity training as this will be the fastest and most viable route to resilience. #cybersecurity #cybersecurityeducation #cybersecuritynews #cyberawareness

1

Last week, the WA Auditor General released a report highlighting serious Microsoft 365 security gaps across government agencies. One entity accidentally exposed sensitive data of 32 individuals, including minors, to a third-party provider, which was later compromised. No DLP controls or vendor security checks were in place. A separate organization lost $71,000 to invoice fraud after attackers exploited weak MFA, set up hidden forwarding rules, and studied internal communications. The fraud went undetected for a month, and underlying security gaps remain. The lessons are clear. - Phishing-resistant MFA - Strict data controls - Comprehensive DLP - and robust vendor assessments These aren’t optional — they’re essential. Cybersecurity is as much about process and accountability as it is about technology. Read the Auditor General's report: https://lnkd.in/gmyQs_3z #CyberSecurity #DataProtection #Microsoft365 #GovTech

3

1 Comment

Threat intelligence is a surprisingly powerful tool for understanding and managing software supply chain risk. Here are 4 ways it helps: 1. Proactive Threat Hunting Threat intel gives security teams indicators of compromise (IoCs) and attacker behaviours (TTPs) so they can hunt for hidden risks before they become major incidents. 2. Smarter Vendor Assessments Threat intel brings data-driven insights into how secure your suppliers actually are, from their exposed attack surfaces to leaked data and known vulnerabilities. 3. Software Bill of Materials (SBOMs) By mapping SBOM components against vulnerability databases (like CVEs), teams can see exactly where their risks lie and prioritise remediation. 4. Real-time Monitoring Modern platforms use live threat feeds to detect unusual API activity or suspicious access attempts across your supply chain, giving teams the visibility to act fast. Each software decision creates new dependencies, and each dependency introduces uncertainty. Managing that uncertainty with real data is the core of supply chain resilience. #CyberMonth2025

1

🧭 Identity risk grows quietly when access reviews slip. ASD guidance continues to highlight privilege creep and weak identity governance as key contributors to incidents. You don't need perfect IAM tooling to start. You need: ✔ MFA everywhere ✔ regular access reviews ✔ removal of shared accounts That's access discipline. Source: Australian Signals Directorate — Annual Cyber Threat Report 2024–25 https://lnkd.in/ggFg_BYu #IdentityGovernance #AccessManagement #IncightInsights #Hospitals #Schools #AgedCare #OperationalResilience #ASDReport

2

Many organisations treat SOC 2 and ISO 27001 as two separate compliance projects. That assumption usually leads to duplicated controls, duplicated documentation, and exhausted security teams. In reality, most mature security programs already operate a single set of core controls. The challenge is not building security twice. The challenge is understanding how those same controls are assessed differently across frameworks. This carousel breaks down the control domains that can be mapped directly from SOC 2 to ISO 27001, why the overlap exists, and how treating frameworks as lenses instead of silos reduces audit fatigue while strengthening assurance. If you are working on SOC 2, ISO 27001, or both, this perspective can change how you design and scale your security program. www.datasec.co.ke #SOC2 #ISO27001 #InformationSecurity #Compliance #GRC #CyberSecurity #RiskManagement #ISMS #SecurityLeadership

7

Attention CISOs and Security Leaders: The Australian cyber threat landscape is experiencing a highly aggressive pivot. Based on recent threat telemetry, Lean Security is observing a rapid shift in the tactics, techniques, and procedures used by adversaries to breach critical sectors. Our latest threat intelligence analysis highlights several escalating risks that require immediate strategic focus: 1. The Weaponization of AI: Threat actors are leveraging Generative AI for highly convincing phishing campaigns, AI-automated credential stuffing that easily bypasses traditional web defenses, and prompt injection attacks targeting newly integrated enterprise AI systems. 2. Identity-Driven Cloud Attacks: With identity functioning as the new perimeter, we are seeing a surge in sophisticated attacks targeting Azure Entra ID to bypass Multi-Factor Authentication, alongside severe AWS IAM misconfigurations. 3. Malicious Insider Threats: Recent industry reporting confirms that intentional insider incidents are now rising faster than negligence-based threats across Australia, requiring stricter internal access controls. 4. Edge Infrastructure and API Exploits: Active exploitation of edge devices is allowing state-sponsored actors to bypass traditional perimeters entirely, while undocumented Shadow APIs remain a prime target for backend database scraping in the FinTech and SaaS supply chains. Relying on passive defense mechanisms and baseline compliance is no longer viable. Australian organizations must adopt a proactive, assume-breach mentality to rigorously validate their security controls. We explicitly encourage you to view the full article on our website for a comprehensive, sector-by-sector technical analysis covering Australia's Healthcare, Government, FinTech, SaaS, Education, and eCommerce industries. While you are there, contact Lean Security for a quote to see how our targeted penetration testing and adversary simulation services can help secure your infrastructure against today's most sophisticated threat actors. https://lnkd.in/gP7vdAgR #CyberSecurity #ThreatIntel #Australia #PenTesting #CISO

2

IT CYBERSECURITY: CYBER SKILLS SHORTAGE? OR FILTER PROBLEM. “54% shortage” — yet 485 applications disappear. No SIEM exposure. No Australian privacy framework knowledge. → Instant rejection. Reviewed 200+ profiles. Same pattern every time: The experience loop is brutal. 2026 reality: PMSOL data shows ~67% ICT Security profiles get rejected due to ISO 27001 gaps. Quick pivot: TryHackMe + NIST mapping → turns learning into proof (not just claims). Now the real question: Is it lack of experience… or lack of visible proof? What’s blocking you right now — local experience or certifications? Let’s unpack 👇 For daily 482 job alerts, updates, and community support, you may also 📱 Join our WhatsApp group here: [https://lnkd.in/gzMCNbxw] For regular updates on 482 sponsorship jobs, skills assessments, and migration insights, follow Ruby Malik | Sachin K. | 482 Sponsorship Jobs In Australia | Skills Assessment School Australia | What To Study for PR Pathway (Australia). We do not sell jobs, sponsorships, or guaranteed migration outcomes. We are not a recruitment agency. Migration advice is provided only by a MARA-registered migration agent under a formal agreement. All decisions remain with employers and relevant authorities. #CyberSecurity #InfoSec #CyberJobs #TechCareers #ITJobs #CyberTalent #CyberSkills #JobSearch #CareerGrowth #LinkedInTips

20

Patching should be routine, but all too often, it isn't. The NCSC, ACSC, and counterparts underline that successful attacks frequently stem from known vulnerabilities that should have been patched. To stay ahead, organisations must lean into: • Automated Inventory + Patching – Manual dependency can’t keep pace with the scale of vulnerabilities and asset complexity. • Continuous Reporting – Tracking patch rollout and coverage in real time empowers teams to spot gaps—and communicate them to stakeholders—before they become incidents. • Mitigation for Unpatchables – Some systems cannot be patched, but that doesn’t mean they are forgotten. Effective risk mitigation strategies must be in place. Huntsman’s Auditor and Scorecard bring transparency and speed to Essential 8 patching, while SmartCheck supports broader enterprise environments. With automated monitoring and audit-ready insights, patching becomes a verified and effective defence. https://lnkd.in/g8qYvUPC

4

A new active exploit targeting Microsoft SharePoint’s ToolShell has been confirmed. If your school or agency uses SharePoint, flag this to your IT team for immediate review—it's a critical reminder of why proactive threat detection and patching matter https://hubs.la/Q03DgdhY0

1