The Patch Window Is Dead. It’s Time to Automate.

Why traditional patch management can no longer keep pace with AI-accelerated threats, growing vulnerability volumes and modern cyber resilience requirements. Patch management automation is becoming essential as organisations face growing vulnerability volumes, faster exploitation timelines and increasing cyber resilience requirements.

For years, enterprise patch management followed a familiar rhythm. Vendors released updates, security teams assessed the risks, change advisory boards reviewed the impact and patches eventually made their way into production. The process was structured, predictable and designed to minimise operational disruption.

In many environments, it still works exactly the same way today.

The problem is that the threat landscape has changed dramatically while patch management processes have remained largely unchanged.

Attackers no longer operate on timelines measured in weeks. Vulnerability disclosures, exploit development and active attacks are happening faster than ever. As a result, patch cycles that once appeared responsible and controlled are increasingly becoming a source of risk.

Patch management was built for a different threat landscape

Traditional patch management evolved in an era where organisations could afford to be methodical. Vulnerabilities were disclosed, security teams assessed their impact and remediation activities were scheduled through planned maintenance windows.

That model assumed one important thing: defenders had time.

Today, that assumption is becoming increasingly difficult to justify. The volume of vulnerabilities continues to grow, threat actors have faster access to information and the time between disclosure and exploitation continues to shrink.

For many organisations, patch management is no longer a technical challenge. It has become a race against time.

The vulnerability explosion is becoming impossible to manage manually

The volume of vulnerabilities is increasing at a pace that is reshaping how patch management must be approached. CVE submissions have risen by 263% since 2020, creating a workload that makes manual prioritisation and remediation increasingly difficult for security teams.

Even NIST, which maintains and enriches vulnerability data through the National Vulnerability Database (NVD), has publicly acknowledged that it can no longer keep pace with the volume of vulnerabilities requiring analysis. As the backlog grows, organisations cannot rely on slow, manual interpretation processes to decide what needs attention first.

This creates a practical problem for defenders.

Security teams are expected to review, prioritise and remediate an ever-growing number of vulnerabilities while balancing operational requirements, resource constraints and business risk. In many organisations, vulnerability management programs are already struggling to keep up with the volume of issues requiring assessment.

The result is often vulnerability fatigue. Teams spend more time reviewing findings, managing exceptions and discussing priorities than actually reducing exposure.

AI is shrinking the window between disclosure and exploitation

Growing vulnerability volumes would be challenging enough on their own. However, artificial intelligence is introducing another factor that organisations need to consider.

Many defenders are already using AI to improve vulnerability analysis, threat intelligence processing and security operations. At the same time, attackers are using similar capabilities to accelerate exploit development and identify opportunities more efficiently. We explored this trend in more detail in our recent article on how AI is accelerating both cyber attacks and cyber defence.

Activities that previously required significant research and manual effort can now be performed much faster. As a result, the time between a vulnerability being disclosed and an exploit becoming available is shrinking.

This changes the economics of patch management.

A patch cycle measured in weeks may have been acceptable when attackers required significant time to weaponise vulnerabilities. Today, those same timelines can leave organisations exposed long after public disclosure.

Why the ASD Essential Eight changes the conversation

The Australian Signals Directorate (ASD) has already recognised this reality within the Essential Eight framework.

For organisations pursuing higher maturity levels, critical or actively exploited vulnerabilities affecting internet-facing systems may require remediation within 48 hours. Not two weeks. Not the next monthly maintenance cycle. Forty-eight hours.

That expectation reflects the current threat landscape.

It also highlights a challenge many organisations face. Meeting a 48-hour patching requirement across large and complex environments is extremely difficult when patching relies heavily on manual review, multiple approval layers and lengthy change management processes.

The issue is no longer whether patching is important. The issue is whether existing processes can operate at the speed required.

The real problem: humans have become the bottleneck

Security teams are not failing because they lack expertise.

In many cases, they are constrained by processes that were designed for a different era.

Manual reviews, approval chains, maintenance windows and change advisory board processes all have legitimate purposes. However, when every vulnerability requires the same level of scrutiny, organisations often struggle to respond quickly enough to the issues that matter most.

Not every patch carries the same level of risk. Not every system has the same level of criticality. Treating all patching activities as though they require identical governance creates unnecessary delays and consumes valuable resources.

The challenge is not removing human oversight. The challenge is applying human oversight where it delivers the greatest value. Many organisations are now supporting internal teams with virtual SOC capabilities to reduce operational overhead and improve response times.

What modern patch management should look like

Modern patch management should focus on risk-based automation rather than universal manual control.

The objective is not to automate everything. The objective is to automate the activities that can be performed safely and consistently while retaining human involvement where judgement is required.

For example, organisations may choose to automatically deploy low-risk vendor-tested updates on non-critical systems while maintaining additional review processes for higher-risk changes affecting critical infrastructure.

Key takeaway: The question is no longer whether organisations should automate patch management. The question is which parts of the process can still afford to remain manual.

Automation doesn’t mean removing control

One of the most common concerns around automated patching is the perception that automation reduces governance.

In reality, effective automation often improves governance.

Well-designed patch automation includes testing procedures, approval rules, deployment policies, monitoring and rollback capabilities. Rather than removing control, it allows organisations to apply control more consistently and at greater scale.

The goal is not reckless automation. The goal is predictable, repeatable and risk-aware automation.

Organisations should be able to deploy routine updates quickly while maintaining stronger controls around changes that carry greater operational risk.

Want to explore which automations make sense for your business?

Leave your details here to book a conversation with our team and discuss practical opportunities to improve visibility, reduce operational overhead and strengthen cyber resilience.

A practical roadmap towards automated patch management

Most organisations do not need to transform their patch management program overnight.

A more practical approach is to introduce automation gradually.

Stage 1: Improve visibility

Develop a clear understanding of assets, vulnerabilities and patching status across the environment. Visibility is often the first challenge organisations need to solve before they can automate remediation activities effectively.

Learn how Lumenir, our SIEM-as-a-Service offering, helps organisations build the visibility required for modern cyber defence.

Stage 2: Prioritise by risk

Focus remediation efforts on vulnerabilities that create the greatest operational or security risk.

Stage 3: Automate low-risk updates

Identify routine patching activities that can be automated safely and consistently.

Stage 4: Introduce controlled automation

Expand automation through predefined workflows, testing procedures and rollback capabilities.

Stage 5: Continuously optimise

Review outcomes, refine policies and adjust automation strategies as business requirements evolve.

Frequently asked questions

What is automated patch management?

Automated patch management uses software and workflows to deploy updates with minimal manual intervention while maintaining governance and oversight controls.

Why is patch management becoming more difficult?

The number of vulnerabilities continues to increase, attackers can weaponise vulnerabilities more quickly and organisations are managing increasingly complex environments.

What does the ASD Essential Eight require for patching?

The Essential Eight includes specific remediation requirements for operating systems, applications and vulnerabilities, with stricter timelines at higher maturity levels.

Does automated patching increase risk?

Not necessarily. When implemented correctly, automation can improve consistency, reduce delays and help organisations respond more quickly to critical vulnerabilities.

Should every patch be automated?

No. Organisations should apply automation based on risk, business impact and operational requirements rather than adopting a one-size-fits-all approach.

Final thoughts

Patch management has traditionally been treated as a scheduling problem.

Increasingly, it is becoming a speed problem.

As vulnerability volumes continue to grow and attackers gain access to more powerful tools, organisations need to reconsider whether traditional patching processes remain fit for purpose. The goal is not to eliminate human oversight. The goal is to ensure that human expertise is focused where it matters most.

For many organisations, that journey will involve greater visibility, stronger prioritisation and a gradual move towards automation.

The patch window is not disappearing because organisations want it to.

It is disappearing because the threat landscape is moving faster than traditional processes can keep up.

Why AI-powered cyber attacks are outpacing human defenders

Artificial intelligence is changing the speed and scale of modern cyber threats, making AI-powered cyber attacks a growing concern for organisations across Australia.

Over the last four decades, organisations have adapted to several major technology shifts. The rise of the internet, mobile devices, cloud computing, software-defined infrastructure and remote work have all changed how businesses operate and how technology environments are designed, managed and secured. Each of these developments delivered clear operational and commercial benefits, but they also introduced new dependencies, new risks and new opportunities for attackers.

Artificial intelligence is creating a similar transition. Most organisations are currently focused on the productivity benefits that AI can deliver, whether that involves analysing information more quickly, automating repetitive tasks or helping employees make better use of their time. At the same time, attackers are applying many of the same capabilities to activities such as reconnaissance, phishing, vulnerability research and social engineering.

Recent guidance published by the Australian Signals Directorate (ASD) highlights this dual reality. AI has the potential to support defenders by improving threat detection, accelerating investigation processes and reducing the manual effort associated with routine security tasks. However, the same technology can also help threat actors operate more efficiently by reducing the effort required to research targets, develop campaigns and adapt their techniques.

Image: ASD – Integrating AI for cyber security

Australian Signals Directorate guidance on AI in cyber defence

For technology leaders, the question is no longer whether AI will influence cybersecurity. Most organisations are already seeing evidence of that change. A more practical consideration is how security operations need to evolve when attackers can gather information faster, create more convincing content and execute activities at a scale that was previously difficult to achieve.

How AI-powered cyber attacks are changing the cyber threat landscape

One of the key observations in the ASD guidance is that artificial intelligence is not creating an entirely new category of cyber threats. Many of the techniques associated with AI-powered attacks, including phishing, reconnaissance and social engineering, have existed for years. What is changing is the speed, scale and efficiency with which those techniques can be executed.

For most organisations, this is a more immediate concern than highly sophisticated AI-driven attack scenarios. Existing attack methods are becoming easier to execute, more scalable and harder to manage through traditional security operations.

Phishing is a good example. AI can help attackers generate convincing content, adapt messaging to different audiences and produce campaigns at a scale that would previously have required significantly more effort. Similarly, AI can accelerate reconnaissance activities by analysing large volumes of publicly available information and identifying potential opportunities much faster than a person could.

Rather than introducing entirely new attack methods, AI is helping threat actors execute familiar techniques more efficiently. As a result, security teams have less time to identify suspicious activity and respond before an incident develops into a larger operational issue.

Key takeaway

AI is not creating entirely new cyber threats. It is accelerating existing attack techniques and allowing threat actors to operate faster, at greater scale and with less effort than before.

Many security programs were designed around a different operating rhythm. Historically, security teams had more time to investigate alerts, validate concerns and escalate issues before significant damage occurred. As attackers become more efficient and attack volumes increase, that assumption becomes increasingly difficult to rely upon. Consequently, organisations need to think not only about preventing attacks, but also about whether their security operations model is capable of responding at the speed required today.

Why traditional security operations struggle against AI-driven cyber attacks

Most organisations have invested heavily in cybersecurity over the past decade. Firewalls, endpoint protection platforms, identity management systems, email security tools and vulnerability management programs are now standard components of modern IT environments. While these technologies provide valuable visibility, they also generate a significant amount of security data.

The challenge for many organisations is no longer collecting information. Firewalls generate logs, endpoint platforms generate alerts, identity systems record authentication activity and cloud platforms produce audit events. Together, these data sources can create an overwhelming volume of information that becomes difficult to interpret without the right operational processes in place.

As attackers become faster and more efficient, security teams are expected to review increasing volumes of activity while operating with largely unchanged resources. Many organisations already have access to the information needed to identify threats, but determining which events require immediate attention and which represent normal activity can be time-consuming.

Adding more people does not always solve the problem. Experienced security professionals remain essential, but larger teams often inherit larger workloads when the underlying processes for identifying, prioritising and responding to threats remain unchanged.

For this reason, AI-assisted detection, event correlation and automation are becoming increasingly important within modern security operations. Their purpose is not to replace people. Instead, they help organisations process larger volumes of information more efficiently and ensure that human attention is focused on incidents that genuinely require investigation and judgement.

The organisations achieving the best outcomes are not choosing between people and technology. They are combining both to improve visibility, reduce operational noise and respond more effectively to potential threats.

As AI-powered cyber attacks continue to evolve, organisations need security operations that can detect, prioritise and respond to threats more efficiently.

Financial services offer a glimpse of what is coming

Although AI-driven security challenges affect organisations across every industry, financial services provide a useful indication of where cyber resilience expectations are heading. Banks, insurers and financial institutions operate in highly regulated environments, manage sensitive data and depend on complex digital systems to deliver core services.

For that reason, regulators tend to scrutinise not only whether financial organisations can prevent cyber incidents, but whether they can continue operating when incidents occur. This is an important shift. Cybersecurity is no longer being assessed only as a technical control issue. It is increasingly being treated as an operational resilience issue.

Recent commentary from ASIC reflects this broader direction. The financial services sector is being pushed to think more clearly about cyber risk, business continuity, governance and the consequences of failing to respond effectively when incidents occur.

ASIC commentary on cyber resilience and operational risk

Although these conversations are particularly visible within financial services, the underlying principles apply across many other sectors. Education providers, healthcare organisations, government agencies, manufacturers and professional services firms all depend on technology to deliver critical services. In each case, the organisation needs to understand which systems are essential, how long disruption can be tolerated and what actions should be taken if those systems become unavailable.

Question for leadership teams

If a critical business system became unavailable tomorrow, how long could your organisation continue operating effectively?

The question every organisation should be asking

Many cybersecurity conversations still begin with tools. Organisations ask whether they need a new firewall, a new endpoint platform, a SIEM, a SOC service or a SOAR capability. These are valid questions, but they are not always the best starting point.

A more useful starting point is to work backwards from the impact of an incident. If an attacker gained access to a critical system, what would happen next? Rather than focusing solely on the technical compromise, organisations should consider the operational consequences. Which systems could be affected? Would any services need to be isolated? Who would need to be informed? And which actions would need to happen immediately to reduce business impact?

This approach changes the conversation. Instead of treating cybersecurity as a collection of products, it treats it as an operating model. The objective becomes understanding how the organisation detects issues, decides what matters and responds in a way that limits business impact.

That operating model depends on visibility. Without visibility, an organisation cannot confidently understand what is happening. Without that understanding, it is difficult to prioritise risks or automate response actions safely.

This is where many organisations need to focus before moving too quickly into advanced automation. Automation is only useful when the organisation has enough context to know what should happen when specific conditions occur.

A practical roadmap for defending against AI-assisted attacks

For most organisations, the move towards AI-assisted cyber defence should happen in phases. Attempting to automate response actions before establishing visibility and context can create operational risk. A more practical approach is to build maturity progressively.

Stage 1: Visibility

Visibility is the foundation of modern cyber defence. Organisations need to understand what is happening across users, devices, applications, cloud services, network infrastructure and security controls.

This is where a SIEM becomes important. A well-implemented SIEM collects and centralises security telemetry, giving teams a clearer view of activity across the environment. It also creates the data foundation required for later stages of maturity, including AI-assisted analysis and automated response.

For organisations looking to centralise security visibility and improve their ability to detect meaningful activity, Lumenir provides a practical foundation for modern security operations.

Visibility remains one of the most important requirements for detecting AI-powered cyber attacks before they escalate.

Stage 2: Understanding

Visibility alone is not enough. Once information is being collected, the organisation needs to understand what that information means in a business context.

This means identifying critical systems, understanding dependencies, defining acceptable downtime and mapping the potential impact of different incident scenarios. A security alert affecting a low-risk system does not carry the same operational consequence as suspicious activity involving identity systems, finance platforms or core infrastructure.

This stage is important because it informs response decisions. If an organisation understands the potential blast radius of an incident, it can make better decisions about escalation, containment and recovery.

Stage 3: AI-assisted operations

Once visibility and context are established, AI-assisted operations can help security teams work more efficiently. This may include event correlation, anomaly detection, alert prioritisation and noise reduction.

Many organisations do not have the internal resources to monitor security activity continuously or investigate every alert in depth. A virtual Security Operations Centre, or vSOC, can help by providing monitoring, triage and escalation support without requiring the organisation to build a full internal SOC capability.

Explore Virtual SOC and incident response service.

The purpose of AI-assisted operations is not to remove humans from the process. It is to ensure human attention is directed towards activity that genuinely requires investigation and judgement.

This capability becomes increasingly valuable as organisations face a growing volume of AI-powered cyber attacks.

Stage 4: Automated response

Automated response is the stage many organisations associate with SOAR. A SOAR platform allows approved response actions to be executed automatically when specific conditions are met.

For example, if a user account shows behaviour consistent with compromise, an approved playbook may trigger account suspension or forced password reset. If suspicious activity is detected on a critical system, segmentation or isolation steps may be initiated. If indicators of ransomware behaviour appear, predefined containment actions can begin before the incident spreads further.

The important point is that automation should not be uncontrolled. It should be based on approved playbooks, agreed thresholds and clear operational rules. The value of SOAR is that it allows known response actions to happen quickly and consistently when time matters.

Cyber defence maturity model

Visibility → Understanding → AI-assisted operations → Automated response

You cannot automate what you cannot see, and you cannot confidently respond to risks you do not understand.

Securing AI is becoming part of the challenge

While much of the cybersecurity discussion focuses on how attackers are using AI, organisations are increasingly facing a second challenge: securing their own use of AI.

Over the last two years, tools such as ChatGPT, Microsoft Copilot and Gemini have moved rapidly into everyday business operations. In many organisations, employees are already using AI to analyse information, generate content and improve productivity. However, governance frameworks and security controls have not always evolved at the same pace.

As adoption increases, organisations need to understand what information is being shared with AI platforms, how those platforms are being used and whether appropriate controls are in place. Questions around data leakage, prompt injection, access control and AI governance are becoming increasingly relevant.

This shift is creating demand for a new category of security solutions. Platforms such as Fortinet’s FortiAI Gate have been designed specifically to provide visibility, policy enforcement and governance for AI applications. FortiAI Gate product overview

The emergence of solutions like FortiAI Gate reflects a broader trend. AI is no longer being treated as an experimental technology. Instead, organisations are beginning to recognise that AI requires the same level of visibility, governance and risk management as any other critical business system.

Emerging risk

Many organisations already have an AI adoption strategy. Far fewer have a strategy for monitoring, governing and securing AI usage across the business.

While this article focuses on how AI is changing the threat landscape, organisations should also consider the risks introduced by their own adoption of AI tools. Have a read of our latest article, where we explore the AI-related cybersecurity risks that business leaders should be aware of.

The future of cyber defence is operational maturity

When new technologies emerge, organisations often focus on the technology itself. Over time, however, the organisations that adapt most successfully tend to focus on operating models rather than individual tools.

Artificial intelligence is unlikely to be any different.

The organisations that gain the greatest benefit from AI will not necessarily be those with the largest security budgets or the most advanced technology stacks. More often, success will come from understanding how AI changes security operations and using it to improve visibility, decision-making and response times.

Human expertise will remain essential. Security professionals provide context, judgement and business understanding that technology cannot replace. However, asking skilled teams to spend their time reviewing large volumes of low-value alerts is neither efficient nor sustainable.

AI can help solve that problem. By reducing manual effort and improving operational efficiency, it allows security teams to focus on the incidents that genuinely require investigation and action.

Ultimately, the future of cyber defence is not about replacing people with technology. It is about combining visibility, automation and human expertise to build a more resilient security operating model.

Frequently asked questions

What are AI-powered cyber attacks?

AI-powered cyber attacks use artificial intelligence to accelerate activities such as phishing, reconnaissance, social engineering and vulnerability research. Rather than creating entirely new attack methods, AI helps attackers work faster, operate at greater scale and adapt their techniques more efficiently.

How are attackers using AI?

Threat actors use AI to generate convincing phishing content, analyse large volumes of information, automate research activities and scale campaigns more efficiently. As a result, attacks can be launched faster and adapted more easily.

Can AI improve cyber defence?

Yes. AI can help organisations analyse large volumes of security data, identify patterns, reduce alert fatigue and prioritise activity that requires investigation. Many modern security platforms now include AI-assisted detection and response capabilities.

What is the difference between SIEM and SOAR?

A SIEM collects, stores and analyses security data from across an environment. A SOAR platform focuses on automating response actions and executing predefined workflows when specific conditions are met.

What is a virtual SOC?

A virtual Security Operations Centre (vSOC) provides monitoring, investigation and escalation services without requiring an organisation to build a dedicated internal SOC. This approach helps improve security coverage while making more efficient use of internal resources.

What is prompt injection?

Prompt injection is a technique used to influence the behaviour of AI systems through carefully crafted inputs. As organisations adopt AI applications, prompt injection is becoming an increasingly important security consideration.

How can organisations prepare for AI-driven cyber threats?

A practical starting point is improving visibility. Organisations should ensure they have appropriate logging, monitoring and detection capabilities in place, understand the business impact of potential incidents and introduce automation where it provides clear operational value.

Want a practical perspective on cybersecurity?

Cybersecurity discussions often focus on technologies, products and emerging threats. In this video, Alan Kepper answers common cybersecurity questions raised by IT leaders and business decision-makers, drawing on more than 40 years of experience across communications, networking and digital infrastructure. Watch the video here

Speak with our team

Most organisations already have many of the technologies required to improve their cyber resilience. The challenge is understanding how those technologies fit together, where visibility gaps exist and which processes can be improved through automation.

If you’re evaluating your organisation’s security maturity, visibility capabilities or approach to security automation, the Laminar team can help identify practical next steps based on your environment, operational requirements and business objectives. Contact our team.

(more…)

Organisations everywhere are racing to adopt AI, but AI cybersecurity risks are growing faster than most businesses realise. Here’s what’s at stake, what’s already being exploited, and how to govern AI before it governs you.

Table of Contents

1. The Rush to Trust AI—and Why It’s Dangerous
2. The Four Core AI Security Risks Facing Enterprises Today
3. How AI Is Reshaping the Threat Landscape
4. AI Cybersecurity Risks vs Defence: Where Threat Detection Is Heading (2025–2027)
5. Why Data Sovereignty Is the Non-Negotiable Foundation
6. The Human Challenge: Are We Ready for Automated IT Operations?
7. What Business Leaders Should Do Right Now

The Rush to Trust AI and Why It’s Dangerous

Organisations everywhere are racing to adopt AI. But AI cybersecurity risks are growing faster than most businesses realise. Tools that promise to supercharge productivity, automate workflows, and unlock new business insights are landing on desks faster than IT teams can evaluate them. But there’s an uncomfortable truth hiding inside that momentum: the very technology transforming your business is also quietly rewriting the rules of cybersecurity, for attackers and defenders alike.

Last week, at a cybersecurity conference, I came across an article about the rapid uptake of OpenClaw. Within minutes, my threat intelligence feed surfaced a detailed walkthrough from the hacker community on how to attack and manipulate it. It wasn’t sophisticated. It wasn’t even hard to do.

We’ve seen this movie before. Shadow IT exploded with cloud storage. Now it’s back at a scale and speed that makes the last wave look manageable.

The gap between threat evolution and organisational readiness is widening fast. As someone who has spent years in enterprise IT and security architecture, I’m watching this unfold with serious concern. The window to close that gap is still open, but only if we act with urgency and clarity.

The Four Core AI Cybersecurity Risks Facing Enterprises Today

1. Shadow AI: The New Shadow IT

Employees are connecting company data to public large language models (LLMs), agentic platforms, and “productivity boosters” without any IT oversight. Sensitive emails, customer records, and strategic documents are being fed into models that the business doesn’t own, audit, or control.

The result: Corporate and personal data leakage at scale. These are among the most underestimated AI cybersecurity risks facing organisations today. Once information is connected to an unvetted AI, it can be read, summarised, stored, or manipulated—often without any visible footprint.

Quick definition: Shadow AI refers to the unsanctioned use of artificial intelligence tools by employees without IT knowledge or approval—a direct evolution of the Shadow IT problem, but with significantly higher data exposure risk.

2. Model Poisoning and Training Data Attacks

Malicious actors are actively injecting poisoned data into AI training pipelines and live agent interactions. A single compromised dataset or crafted prompt can corrupt an entire AI-driven workflow downstream.

The risk compounds because today’s AI tools are designed to maximise connectivity. More integration means more attack surface. More attack surface means more opportunity for data exposure—often before any alert fires.

3. Prompt Injection in Agentic Systems

This is the risk that keeps security architects up at night.

Agentic AI tools—platforms like OpenClaw and its growing ecosystem of variants (ClawBro, MyClaw, and others) that let users build automated processes connected to email, calendars, internal databases, and cloud services are inherently vulnerable to prompt injection attacks. A malicious instruction, embedded inside an ordinary-looking email or document, can hijack the agent’s behaviour entirely.

The agent executes the instruction at machine speed: exfiltrating data, triggering ransomware, or pivoting deeper into the network before a human analyst has even opened their laptop. These are not theoretical scenarios. They are happening now.

What makes this especially dangerous: many organisations have no visibility into what their agentic tools are actually doing at runtime.

Australia’s own cyber security authority has issued specific guidance on the careful adoption of agentic AI services — a clear signal that this is no longer a niche technical concern.

4. Opaque, Unvetted AI Ecosystems

Many of the most widely-adopted agentic platforms have no clearly identifiable corporate owner, no transparent hosting location, and no verifiable security posture. OpenClaw, for example, is an open-source project that lets anyone run powerful agents locally or in the cloud. Great for speed but a governance vacuum. How do you perform due diligence when you can’t even identify who’s ultimately responsible for the platform your workflows depend on?

Independent evaluations, such as AISI’s assessment of frontier AI cyber capabilities, confirm that the gap between what these models can do and what organisations assume they can do is significant — and growing.

Shadow IT, LLM injection, model poisoning, and data exposure are no longer edge cases. These AI cybersecurity risks are the new baseline threat for any organisation running AI workloads.

How AI Is Reshaping the Threat Landscape

AI isn’t just a tool for defenders. Attackers are using it to move faster, stay hidden longer, and strike more precisely.

• Sleeper compromises are planted months in advance, activating only when conditions are right—long after the initial breach goes undetected.
• AI-generated phishing is now indistinguishable from legitimate correspondence at scale — and attackers are already using it for mass exploitation events, as Google publicly documented it just this past week.
• Deepfake voice and video attacks are being used in business email compromise (BEC) and executive impersonation fraud.
• Supply-chain attacks on AI components are increasing in frequency and sophistication—targeting the models and libraries organisations depend on, not just their endpoints.

The rate of change here is not linear. Traditional perimeter defences were not designed for a world where an attacker can operate inside your AI workflows. Ignoring AI cybersecurity risks at board level is no longer an oversight, it’s a strategic liability. The Australian Signals Directorate has assessed the impact directly: frontier AI models are already reshaping the cybersecurity threat landscape in ways that traditional defences were never designed to handle.

AI Cybersecurity Risks vs Defence: Where Threat Detection Is Heading (2025–2027)

Predicting the exact trajectory is genuinely difficult—the pace of change is too high for precision forecasting. But the directional picture is clear, and the foundation is always the same: data architecture.

Real-Time Visibility Is Non-Negotiable

Modern SIEM (Security Information and Event Management) platforms that collect, correlate, and protect logs in real time give organisations the raw material for meaningful threat detection. Without this foundation, you are flying blind. Every other AI-powered security capability sits on top of it.

Corporate Data Lakes as Crown Jewels

Your historical and real-time operational data is now a strategic asset—and a high-value target. Organisations that invest in governed, sovereign data lakes today are building the infrastructure that future AI security tools will depend on. Those that don’t are accumulating invisible technical and security debt.

Agent-to-Agent Firewalls and Next-Generation DLP

A new category of security tooling is emerging: virtual AI firewalls that sit between your agentic systems and the outside world, inspecting prompts, outputs, and data flows in real time. These platforms can detect and block model-poisoning attempts, flag anomalous agent behaviour, and enforce data loss prevention (DLP) at the AI layer—not just at the network perimeter.

Having seen several of these platforms demonstrated recently, they represent the evolution DLP should have undergone years ago.

SOAR + AI: From Detection to Automated Response

SOAR (Security Orchestration, Automation and Response) platforms, combined with specialised AI tooling, are enabling a step-change in incident response. Detection is the starting point. The real value is in automated triage, containment, and remediation, reducing response times from hours to minutes, at a consistency no purely human team can match.

The prerequisite, always, is trustworthy underlying data.

Why Data Sovereignty Is the Non-Negotiable Foundation

When automated systems make security decisions—or trigger automated responses—the integrity of the data feeding those decisions is everything.

A poisoned data lake doesn’t just corrupt your analytics. It can turn your AI-powered defender into an unwitting accomplice, causing your systems to react to manufactured threats while real ones go undetected. In critical infrastructure contexts, the consequences of this are severe.

Data sovereignty isn’t about isolation. It’s about control and verification. It means knowing where your data is processed, who can access it, and whether it has been tampered with. It’s the difference between responding to a real threat and being manipulated into attacking yourself.

The playbook already exists and sovereign defence organisations have been solving this problem for decades. The enterprise sector needs to apply those same principles to AI governance now, not after the first major incident.

The Human Challenge: Are We Ready for Automated IT Operations?

Here’s the part most technology vendors prefer not to discuss: the biggest risk isn’t the AI itself—it’s the humans racing to adopt it without changing how they think.

I use an analogy from mathematics. When you study calculus, the conceptual leap isn’t just learning new formulas—it’s learning to think in terms of rates of change rather than static positions. Position, velocity, acceleration. Most organisations are still operating in the position plane: reacting to where threats are, not where they’re going.

AI forces a shift to the acceleration plane. It demands that security teams—and the leaders above them—develop intuition for rates of change, not just current states. The same cognitive shift happened when calculators entered the workplace. We didn’t stop doing mathematics; we moved up a level of abstraction.

Most organisations are not yet ready for the full automation of IT security operations. The “rush to trust” culture is recreating the Shadow IT headaches we thought were solved a decade ago. But the organisations that will emerge strongest are those treating this moment as a leadership and cultural challenge, not just a procurement decision.

AI handles velocity and volume. Humans provide context, ethics, and strategic judgment. The goal is not to replace one with the other—it’s to combine them so that both response times and decision quality improve simultaneously.

What Business Leaders Should Do Right Now

The window to close the gap between AI adoption and AI governance is still open. Here’s where to focus:

1. Establish clear AI governance policies. Define which tools are sanctioned, which data they can access, and what oversight exists. No exceptions for productivity gains.
2. Invest in modern data architecture now. A governed, sovereign data lake is the foundation for every AI security capability you will need in the next three years. Build it before you need it.
3. Deploy layered AI security tooling. SIEM, SOAR, and next-generation AI firewalls and DLP are not optional for organisations running agentic workloads. Protect the workflows, not just the perimeter. (If you’re looking for a managed starting point, our Lumenir service brings all of this together as a single, governed cybersecurity-as-a-service offering.)
4. Insist on data sovereignty for automated decision systems. Any system that makes or triggers automated responses must have auditable, verified data provenance. No exceptions.
5. Train your people to think in the acceleration plane. Security awareness is no longer enough. Your teams need to understand AI-specific attack vectors, question the provenance of every new tool, and develop intuition for how fast the threat landscape is moving.

The Bottom Line

AI is not a future risk. It is a present one already being exploited, already widening the gap between organisations that govern it and those that don’t.

The balance every business leader needs to strike is precise: address AI cybersecurity risks head-on and turn AI into a force multiplier for your capabilities — not an invisible backdoor for attackers. That balance is achievable. But it requires treating AI security as a board-level strategic priority today—not after the first incident, and not after the governance conversation becomes unavoidable.

The organisations that act now will be the ones still standing—and genuinely thriving—when the dust settles.

Ready to close the gap between AI adoption and AI security? Talk to the Laminar team. We’ll help you build a governance framework that protects your AI workloads without slowing your business down.

The cyber security threats derived from email are significant and encompass simple cons to sophisticated cyber attacks.

Over the last 40+ years, our email journey has seen many improvements, but the primary function has stayed the same. That is, you send some information to an email address like a blind transmission. You can never be 100% sure somebody has read it. There are at least three uncertainties:

• You can receive emails from people you don’t know
• You cannot always validate the sender’s identity
• You cannot be sure that the information was not changed on the way

I have noticed many organisations use emails as the enterprise filing system. That is, humans have become highly connected to email. Even those who are wise to the threats are sometimes fooled or conned. For example, many people are still being conned or falling for scams and redirecting payments to others. The challenge is that humans open the email and are easily fooled by cyber criminals.

Only some people keep up with the current technology. For example, some organisations still host their own mail exchange servers! Most of us now use a cloud provider like Microsoft or Google that do a reasonable job of filtering out unwanted emails, and some still use special email filtering tools. But still, harmful content gets through.

Big organisations like Microsoft have had severe cyber attacks and breaches in the last few months. Although this has potentially made their platform less trustworthy, it is still useful – however, I have become more wary.

75 – 80% of all successful cyber attacks start with an email, such as a phishing attack (various sources – Deloitte’s/ACSC). The role of email beyond the initial attack vector is also a consideration, such as manipulating staff or external client relationships.

One of the critical technical challenges is that one platform (interface) is used for internal and external communications. Focusing on isolating internal and external as separate systems could mitigate much of the risk. External email communications these days should be treated as corrupted! If emails are corrupted, and the human has to decide to open or not open, with the advent of new AI-based cyber attacks, this will naturally become a more significant threat.

One click on one of those special external emails, and it’s all over potentially! The spam and sheer number of emails that hit our inboxes is sometimes daunting, making it hard to clear the email box quickly and increasing the chance of opening the wrong thing. The problem is a human one, so we may need to create a simple alternative.

What if we use email for external communications only and Secure Instant Messaging (SIM) for all internal communications?

SIM systems include LamChat (the Australian system we built) and Signal, for example. Email was created for simple data transfer, and its scope has been stretched since then. SIM, like LamChat, is far more secure and modern. Before any SIM communications can begin, a trusted connection between parties needs to be established. After that, sophisticated encryption methodologies are engaged to secure the communication with other parties. It’s also a separate system, so human nature can work to our advantage as they will require a different focus when using the SIM system vs. email (being used for external communications only). The modern SIM systems are more capable and more sophisticated than email and offer the following core features:

• Confidentiality
• Integrity
• Authentication
• Participant consistency
• Destination validation
• Forward secrecy
• Backward secrecy (aka future secrecy)
• Causality preservation
• Message unlinkability
• Message non-repudiation
• Participation non-repudiation
• Asynchronicity
• Anonymity preservation

Email does none of these things in its standard form.

If your organisation suffers a cyber breach, how will your people communicate? Will they use the same email and maybe Teams system that was compromised (many do, by the way)? This is highly risky, as hackers typically gain control of email accounts and therefore, teams messages, files and so on. In many cases, the attackers read/watch what happens in the organisation while dealing with the cyber attack. Some organisations use a secure messaging system separate from everything else as part of their cyber security incident response. What does your cyber attack response plan call for?

Why not use a secure messaging system for all internal communication and potentially with trusted third parties (such as suppliers)? Consider this scenario: a company CEO asks the CFO to make a payment via SIM, and the CFO has been instructed never to create a payment if requested by email – any external email with instructions will be disregarded. In another scenario, all employees open emails expecting them to be corrupted by a phishing attack or some scam (even if they are from an internal account). How would human behaviour change?

The advent of a modern SIM system allows an organisation to work differently. Guess what? The transition will cost nothing! You just need to train the humans to work a bit differently! But, doing so will radically change the cyber threat landscape for your organisation.

Who else is doing this, you might ask? The answer is most Governments, Military and security-sensitive organisations worldwide.

Feel free to experiment with our free LamChat system, use many other services or build your own (we can help you with this!).

There is so much potential (both good and bad) with the adoption of modern technology. The impact to human kind will ultimately be determined by how humans use it. The Australian Cyber Security Strategy could have a big impact on the lives of Australians in the very near future. We are very optimistic for what digital technologies can do for our future, and we embrace the efforts of the 2023-2030 Australian Cyber Security Strategy submission to balance the advantages of the digital economy with the potential risks of misuse and protecting people.

Read our discussion paper submission here.

This essay provides an interesting perspective on the power of the Oblong and how it might be used to manipulate humans. The author effectively uses examples from books like 1984 and Brave New World to illustrate the potential consequences of relying too heavily on the Oblong. The essay also discusses the divide between those who understand the potential danger of the Oblong and those who blindly trust it. Overall, the essay offers an interesting and thoughtful take on the power of the Oblong.  –  OpenAi engine…

I stole the concept of the Oblong from a book I read, Clara and the Sun, by Kazou Ishiguro.

The Oblong is the main or only source of information that humans use to make decisions about their life.  What to eat, where to go, what to think, who to hang out with and what to do!  Years ago humans used their 5 senses to make migratory, hunting, social and other critical decisions. Now the Oblong sits between the humans main senses, (visual, auditory, touch) and the real world to help the humans make sense of a huge amount of information and interact with each other and the universe.

What if the humans think they control their Oblong when in fact some one else controls the Oblong, what is presented and therefore controls the behaviour of the humans decision making. The humans often consider the aura of the oblong, its beauty and almost religious connection to a brand as they rush to trust something they don’t comprehend how it works.

What of the gap between knowledge of technology and the users of it.

George Orwell’s book, 1984 foreshadows (at the time) how restriction of information could or would be used to control the masses.  He feared books or publications would be banned that presented an alternate view of the ruling political elite.  That is, controlling the humans with deprivation or limiting of information.

Aldus Huxley – author of Brave New World, looks at the control of humans by providing an over supply of information.  I have read that Huxley feared no one would read books, which is a very different take on things to Orwell. He was apparently concerned that if humans were presented with too much information that humans would be reduced to passivity and egotism.

Two ends of the spectrum maybe, but I suspect we might be hovering at one end at the moment.

Through the Oblong humans are presented with so much information, more than they scan process and work with. Emails, Social media, messaging, video, music, news and a range of APPs.  Add to that a rush to trust the latest cool APP with expectation spooled up by clever marketing.

Very few have the ability to understand how the APP is working so most jump on and share videos or other details while the APP is doing something else. Collecting data.  Even if you understand how it works and what is going you have to ostracise yourself from the rest of society to make sure you are not affected.  Is it worth that? How lonely!

Maybe politicians can establish laws to bring some control but how were those politicians chosen.  What is the of source of information the human used to make a decision on who to elect?

We released a messaging and social media application (LamChat) so that people can share stories and information securely without being tracked and the APP/System does not collect other information about the user.  There are people who care about this confidentially and they use a system like LamChat, but they represent a very very slim minority.

Now we have had a series of publicised cyber security events that have affected a great deal of the population. There are several that have gained notoriety but these only represent a few in a long list of successful attack in the last few months.  Why didn’t you hear about them? You probably did and its buried in the white noise of constant information overload.

Many of us in the cyber security industry figure out what has happened to a victim sometimes before the victims management or board do.  It must be frustrating for them. They have built a business and profited from the efficiencies and speed of the digital revolution. They have typically not dealt with the human disciplines of operating infrastructure around security the value of information and the trust people place in them.

I think about the divide between the people whom know and those that blindly trust. In the past a government or ruler would make some laws to protect or manage the disruption to the kingdom to keep control and order.  We have seen our government follow many others around the world to impose large fines on operators of infrastructure that people trust.  The laws around privacy in Australia have been around for 4 years but the fines have just been increased dramatically and obligations for reporting have tightened in the last 2 months.

But what are we doing around the power of the Oblong and the impact it could have on our society if the power is misused?

Want to find out more? Contact us.