cyber security Archives - �鶹ԭ�� Australia & New Zealand News Center

Five takeaways on AI governance, trust and innovation

Rebecca English — Tue, 07 Jul 2026 00:35:23 +0000

By Marielle Ehrmann, Chief Security Compliance and Risk Officer, �鶹ԭ��

Marielle Ehrmann, Chief Security, Compliance and Risk Officer, �鶹ԭ��

As AI adoption accelerates, leaders face urgent questions: where is AI being used, what data is it touching, who is accountable and what happens when something goes wrong?��

Those questions sit at the heart of a recent KBI Media podcast conversation with Marielle Ehrmann, �鶹ԭ��’s Chief Security, Compliance and Risk Officer. Her message is clear: done well, AI governance is not a brake on innovation, it is the accelerator.��

For leaders across Australia and New Zealand, that matters now. In many organisations, AI is moving at startup speed while governance is moving at committee speed. According to , nearly all organisations are at least in the process of integrating and scaling AI, yet only around a third have responsible controls in place.��

Here are five takeaways on turning AI governance into a source of trust, resilience and advantage:

1. Boards have moved from excitement to accountability��

Not long ago, many boardroom conversations about AI centred on speed: how quickly it could be deployed, where it could drive productivity and how it could create competitive advantage.��

Those questions still matter. But, as Ehrmann observed, the conversation has become more sophisticated. Boards are now asking a sharper version of the same question: how fast can we deploy AI without ending up on the front page of the Wall Street Journal?��

That shift makes sense.

“AI has moved from being a cool technology experiment to something that can materially impact revenue, reputation, intellectual property, regulatory exposure, but also customer trust,” Ehrmann said.��

That is a significant shift. AI is no longer a technology discussion alone. It is a governance, legal, cybersecurity, reputational and business continuity discussion all at once. For leaders, that means AI governance must be elevated beyond a specialist function and treated as a boardroom priority.��

2. Good governance is the accelerator, not the brake��

One of the strongest ideas from the conversation is also one of the most important for organisations trying to balance ambition with accountability: governance does not have to slow innovation down.��

“Good governance is really becoming the accelerator pedal, not the brake pedal,” she said.��

It is a powerful reframing. Too often, governance is treated as something that arrives after innovation: a checkpoint, a hurdle or a process to be navigated once the exciting work is done. With AI, that approach creates risk. If governance lags too far behind deployment, organisations can quickly lose visibility over where AI is being used, what data it is touching, who is validating outputs and who is accountable when something goes wrong.��

Governance, when designed well, creates clarity. It gives teams the confidence to innovate within clear boundaries and helps make AI adoption sustainable.

As Ehrmann put it, “The companies that build trust the fastest are often the ones that innovate also the fastest in the long run.”��

3. AI risk is as much about people as it is about models��

When organisations talk about AI risk, it is natural to focus on the technology itself: the model, the data, the outputs and the architecture. But Ehrmann was clear that the bigger risk often sits somewhere more familiar.��

“Most executives are realising now that the biggest AI risk usually isn’t the model itself, it’s the human behaviour around the model,” she said.��

That human risk factor is already playing out in practical ways. Employees may paste sensitive information into public AI tools, trust AI-generated outputs too quickly, or move faster than the organisation’s guardrails allow. For many organisations, AI adoption does not start with a formal strategy. It starts with employees opening a browser tab.��

That is why Ehrmann describes the task as giving people “freedom within boundaries”. Organisations need to give teams room to explore AI and unlock value, while being clear about the limits. That requires policies, education, oversight, data controls and clear accountability for AI risk.��

4. Responsible AI is operational discipline, not AI theatre��

There is no shortage of AI strategy decks, transformation slogans or executive panels. But as organisations move from experimentation to scale, Ehrmann suggested it becomes easier to distinguish responsible AI from what she called “AI theatre”.��

“You can usually spot the difference within the first 15 minutes of a conversation,” she said. “If you ask a very simple question on who owns AI risk here, suddenly the room gets quiet.”��

That question matters because responsible AI must show up in the way an organisation operates. Can leaders say where AI is being used? Do they know what data is involved? Is there a human in the loop validating outputs? Are policies in place? What happens if AI gets something wrong?��

“AI governance shows up in operational discipline, not in PowerPoint slides,” Ehrmann said.��

Governance claims are easy to make. Proving them is harder. That is where external certification becomes valuable, not as a marketing exercise, but as a discipline that forces organisations to codify, measure and defend their practices against an independent standard.

At �鶹ԭ��, we were among the first large enterprises to achieve ISO 42001 certification for AI governance in Q3 2025, reflecting the company’s focus on building trust with customers and helping them adopt AI with confidence.��

The broader point for business leaders is clear: responsible AI is not a branding exercise. It is an operational capability.��

5. Trust is becoming a competitive advantage��

As AI becomes more embedded in business processes, customers are asking more sophisticated questions. They want to understand how models reach conclusions, how data is protected, how risks are managed and who is accountable.��

For Ehrmann, that growing demand for transparency is not something to resist. It is part of what trust now requires.

“The winning ones will be those who have built governance and can move at the speed of innovation, and that is actually creating trust,” she said.��

That idea is especially important as AI governance continues to evolve across jurisdictions. Ehrmann pointed to the need for stronger harmonisation and standardisation across the regulatory landscape, so organisations of all sizes can navigate their responsibilities more clearly.��

In the meantime, organisations cannot afford to wait. AI is already moving through the enterprise. The question is whether governance is moving with it.��

Moving from AI experimentation to responsible AI at scale��

The pressure to use AI is real. Customers expect faster, smarter experiences, while employees and competitors are moving quickly.��

But speed alone is not enough. As Ehrmann put it, innovation gets applause, but good governance keeps you in business.��

For organisations across Australia and New Zealand, AI governance is becoming the foundation for trusted innovation: giving people freedom to explore while protecting customers, data, reputation and trust.��

Listen to the full podcast to hear more from �鶹ԭ��’s Marielle Ehrmann on governing AI with confidence.��

The post Five takeaways on AI governance, trust and innovation appeared first on �鶹ԭ�� Australia & New Zealand News Center.

The Impact of Cyber Attacks on the Utilities Sector in Australia

Jonathan Fogarty — Mon, 20 Jun 2022 03:00:25 +0000

Increase in cyber attacks in the last 12 months

I’m sure for many of us out there, the increase in online scams, phishing attacks, and just straight out shonks taking advantage of the non-technically literate is a real concern.

It turns out that this is just the tip of the digital iceberg. Entire nations can be the target of this growing industry.

has found itself severely compromised of late with hackers launching an unprecedented attack that affected 29 public institutions, including the ministries of finance, social security, meteorology, electricity, sciences, innovation, technology and telecommunications.

published earlier this year titled: “Cyber Attacks Increased 50% Year over Year” revealed in late 2021 there was an all time peak in weekly cyber attacks, averaging over 900 attacks per organisation. Just let that number sink in for a moment. Over 900 per week.

In the study, it revealed that Education and Research were the most attacked sector (average attacks per week 1605 – up by 75% from the previous year) with Utilities companies not far behind with a staggering 736 attacks per week – up 46% from the previous year.

Local Impact for on Utilities Sector

How does this impact Utilities organisations here in Australia? And more importantly how do they respond to these threats, particularly as many have infrastructure that falls squarely under the auspices of the

This is not a simple question to answer.

risk is becoming increasingly difficult for Australian utilities and critical infrastructure operators to manage. Digital transformation is accelerating with, IT and OT landscapes expanding as these new security threats are surging whilst the demand for IT and cyber skills in Australia is at an all time high. Maintaining in-house talent, process governance and eliminating human error is more challenging than ever before.

One significant step �鶹ԭ�� has taken is to establish the �鶹ԭ�� Critical Data Cloud a fully managed service capable of powering the operations of government and regulated industries across both Australia and New Zealand. This is designed to help protect the core business applications of governments and highly regulated industries including financial services, healthcare and utilities. The platform is designed to meet the Australian Government’s Official: Sensitive and Protected information standards.

Opportunity for Utilities Organisations

�鶹ԭ�� Critical Data Cloud is a significant investment recognising the increased focus on improving whole-of-economy cybersecurity.

Leveraging its work with �鶹ԭ�� National Security Services (NS2), �鶹ԭ�� Critical Data Cloud is tailored for Australian and New Zealand legislative requirements. It empowers public and private customers to rapidly and safely digitise customer, citizen and employee services, while remaining current with legislation and policy.

Utilities organisations will be able to wrap an increased layer of security around their customer data, asset and employee information to help protect against the style of attack seen in places like Costa Rica.

Learn more about �鶹ԭ�� Critical Data Cloud visit our and download the report on

The post The Impact of Cyber Attacks on the Utilities Sector in Australia appeared first on �鶹ԭ�� Australia & New Zealand News Center.

�鶹ԭ�� Critical Data Cloud to launch in Australia and New Zealand

�鶹ԭ�� News — Wed, 28 Apr 2021 08:46:40 +0000

Hardened platform to deliver local cloud services designed for��government and regulated industries

Canberra, Australia��—��(NYSE: �鶹ԭ��) today announced��鶹ԭ�� Critical Data Cloud, a fully managed service capable of powering the operations of government and regulated industries across both Australia and New Zealand

This is designed to help protect the core business applications of governments and highly regulated industries including financial services, healthcare and utilities. Planned to be operational in the second half of 2021, the platform is intended to support the Australian Government’s��Official: Sensitive��and��Protected��information, enabling customers to make faster, more informed decisions and with greater peace of mind.

�鶹ԭ�� Critical Data Cloud is a significant investment recognising the increased focus on improving whole-of-economy cybersecurity. The hardened platform provides customers the full functionality of �鶹ԭ��’s multi-tenanted cloud applications. ��It is initially available for human resources (�鶹ԭ�� SuccessFactors) and �鶹ԭ��’s full suite of finance, analytics and machine learning applications (�鶹ԭ�� Business Technology Platform, �鶹ԭ�� Analytics Cloud and �鶹ԭ�� S/4HANA).

In addition to providing customers with the constantly evolving benefits of contemporary business cloud applications, �鶹ԭ�� Critical Data Cloud enables customers to extend functionality within the same certified framework. Importantly it also supports secure integration to other systems, for example public cloud, bespoke applications.

�鶹ԭ�� Critical Data Cloud services and applications are continuously reviewed and hardened to ensure they stay current and are projected to meet evolving government security policy requirements. Customers are offered transparent assurance that data remains supported by appropriately cleared personnel.

“The legislative environment and cyber considerations in both Australia and New Zealand require organisations of different sizes to think hard about moving to cloud,” Damien Bueno, President and Managing Director, �鶹ԭ�� Australia and New Zealand said.

“In support of those pursuing a cloud agenda, �鶹ԭ�� is providing a service that puts all its software and service assets in an environment that exhibits the cloud and security characteristics needed to meet the legislative and security requirements of government.

“As a global enterprise provider and supporter to some of the world’s largest organisations, we’ve looked at how to drive efficiencies and provide customers with the capacity to deliver the sovereignty, security and confidence they need from a trusted platform. This follows the launch of��, providing customers with everything they need to transform their organisation in a way that works best for them.”

Richard Bergman, Lead Partner for EY’s Oceania Cybersecurity, privacy and trusted technology practice, said, “Planned changes to the Security of Critical Infrastructures Act and the increasing prevalence of foreign interference targeting the Australian public and private sector are driving an increasing need for sovereign cloud and security solutions and services.”

“�鶹ԭ��’s approach leveraging hardened patterns and templates is a great way of assisting Australian organisations to combat the increasing threat landscape and changing regulatory requirements,” continued Mr Bergman.

Leveraging its work with��(NS2), �鶹ԭ�� Critical Data Cloud is tailored for Australian and New Zealand legislative requirements. It empowers public and private customers to rapidly and safely digitise customer, citizen and employee services, while remaining current with legislation and policy. This reduces the cost and complexity of assessing and certifying multiple systems and platforms.

Visit the��鶹ԭ�� News Center. Follow �鶹ԭ�� on Twitter at��.

To find out more about the �鶹ԭ�� Critical Data Cloud, visit the��.

About �鶹ԭ��

�鶹ԭ��’s strategy is to help every business run as an intelligent enterprise. As a market leader in enterprise application software, we help companies of all sizes and in all industries run at their best: 77% of the world’s transaction revenue touches an �鶹ԭ��® system. Our machine learning, Internet of Things (IoT), and advanced analytics technologies help turn customers’ businesses into intelligent enterprises. �鶹ԭ�� helps give people and organizations deep business insight and fosters collaboration that helps them stay ahead of their competition. We simplify technology for companies so they can consume our software the way they want – without disruption. Our end-to-end suite of applications and services enables business and public customers across 25 industries globally to operate profitably, adapt continuously, and make a difference. With a global network of customers, partners, employees, and thought leaders, �鶹ԭ�� helps the world run better and improve people’s lives. For more information, visit��

About �鶹ԭ�� NS2

At �鶹ԭ�� NS2^®, we support the mission of national security by providing innovative computing, analytics, and cloud solutions. From custom development to secure cloud, and virtually everything in between, �鶹ԭ�� NS2 powers the secure intelligent enterprise. Learn more at��.

The post �鶹ԭ�� Critical Data Cloud to launch in Australia and New Zealand appeared first on �鶹ԭ�� Australia & New Zealand News Center.

Security versus agility: how do we achieve the best of both worlds?

Lindsay Morgan — Wed, 24 Mar 2021 00:26:39 +0000

If 2020 taught us anything, it’s that the weakest link often defines the strength of a chain. This is likely what a NSW government-sponsored taskforce of industry leaders had in mind when they called on federal, state and local governments across Australia last month to .

The taskforce also urged governments to more favourably evaluate proposals or tender bids from companies that adopt cyber security and other risk standards for telecommunications and the internet of things (IoT). Again, they know that without security being front of mind throughout the supply chain, vulnerabilities can creep in.

The taskforce’s recommendations for federal, state and local government agencies follows in the wake of the government moving to expand the label of “critical infrastructure” and create new security obligations and mandatory reporting for various public and private organisations via the draft legislation on Protecting Critical Infrastructure and Systems of National Significance.

These organisations could face steep penalties if they ��ǲ�’t answer the call to become deeper partners with Australia’s government in all aspects of security, particularly cyber.

The government is clearly taking a more holistic approach to cyber security – and so are enterprises. But this gets tricky once you factor in cloud solutions (Public and Private), whose agility and scalability are increasingly necessary for organisations to capitalise on the value of rich data, streamline distributed operations, realise cost efficiencies and make better use of contemporary and emerging tech.

However, platforms like �鶹ԭ�� HANA have evolved over a decade to help reconcile some of these tensions. Let’s take a look at how.

Can cloud solutions complicate security?

Regardless of architecture, security teams have to think carefully about who has access to data and how they’re accessing it.

Most recently, with on-premise architecture, it was a little more like a traditional building with an entrance and an exit. It’s a lot simpler to control security when you’re managing limited entry points. While many or even most cloud providers have robust security measures in place, cloud solutions do come with more entry points.

However, the security of those entry points differs based on public versus private cloud, as well as a wide variety of factors. For instance, within public cloud, there’s simply a greater number of side doors that require the same level of security. With private cloud, you control who has a door and what you let in and out.

That doesn’t mean organisations should sacrifice the benefits of all public cloud solutions – in fact, that might do more harm than good. It just means that security considerations need to govern any decision to bring new cloud extensions or providers into your environment. But ensuring scalable, enterprise-wide solutions is where things can get trickier.

Solutions that marry security with flexibility

In many organisations, elements of information are taken out of core systems and put into other data lakes, repositories or spreadsheets. The same piece of information is not only repeated in multiple areas but also with varying degrees of security applied to each of those different locations. If the weakest link determines the strength of the chain, then this approach means there are far more links whose strength is even harder to control or test.

Solutions like �鶹ԭ�� HANA, whose 10-year evolution has always been anchored in protecting information and assets, can go a long way to resolving this sort of issue. As an enterprise-scale in-memory database designed to allow end users to have a conversation with their data, HANA caters to large volumes of data and diverse use across a broad user community. The way this can be leveraged for better security is simple: the more information you have in a secure, controlled, unified container, the easier it is to protect that information with centralised security measures.

HANA also enables real-time anonymisation of data displayed in SQL views. This means companies can analyse even the most sensitive and regulated of records – such as those in healthcare – while still protecting data and supporting compliance with privacy standards like the European Union’s General Data Protection Regulation (GDPR).

Solutions like Data Warehouse Cloud are the next evolution in further resolving tensions between innovation and security. It allows organisations to extend secure data environments to secure cloud solutions, combining features of HANA with the rigorous security frameworks provided by a range of hyper-scalers. So, even in complex multi-cloud systems, you can achieve a consistent enterprise-wide data management framework and connectivity to other systems, whether that be public, private, on-premise systems or ubiquitous data sources like IoT devices.

Changing how we think about cyber security

Various types of platforms and architectures can help achieve robust, enterprise-wide security frameworks without sacrificing the benefits of cloud. But strengthening your security posture will also depend on shifting mindsets and educating stakeholders about cyber security and management of risk. There are plenty of business imperatives for this already, but 2021 will see additional regulatory control and incentives as the federal government takes a bigger role in cyber security.

Two big mindset shifts need to happen across all of industry and critical infrastructure sectors. First, when it comes to IT systems and reporting environments, we too often test them based on how we expect them to perform. Particularly from a security perspective, we need an extra level of testing that focuses on what malicious actors want to do and what they’re going to try. It’s important to test systems based on how we want them to be used but also how we ��ǲ�’t want them to be used.

Secondly, we often talk about how to collect data, store data and extend data. Cyber security compels us to ask: what are we going to do with this data? How will people use it? This is particularly crucial now that workers are less tethered to offices or corporate networks. It’s more important than ever to think about the potential usage of data and truly consider its security risk, ensuring that the device and solution set you’re using to present or extract that data is genuinely secure.

Major crises and national challenges in 2020 have reinforced the importance of collective success – when even one element struggles, so does the larger group. It’s an especially important principle in cyber security, where the tiniest vulnerability can open entire ecosystems to potential harm.

Yet the choice between security and innovation is a false one. Still, the topic is undeniably complex and demands ongoing discussion and thought.

So, what are you doing to protect your organisation while still pushing it forward?

This first appeared on

To find out how �鶹ԭ��’s Business Technology Platform can help meet your security needs, visit the .

The post Security versus agility: how do we achieve the best of both worlds? appeared first on �鶹ԭ�� Australia & New Zealand News Center.