In Australia’s National Interest - Security of Critical Infrastructure

By 30 June 2027, a CIRMP subject to the CIRMP Enhanced Rules 2026 needs to be current against the 2027 Enhanced obligations. Therefore, the 2027 annual CIRMP report should address 2027 changes. The Enhanced Rules 2026 Explanatory Statement expressly says that during the 24-month grace period (ending 10 June 2028), annual CIRMP reporting and regulatory engagement will be used by the Department of Home Affairs to assess whether SOCI entities are progressing towards the Enhanced requirements deadlines of 10 June 2027 and 10 June 2028. So, CISC may ask a SOCI entity about its readiness/progress toward the 2028 requirements in the 2027 annual reporting process, although those requirements are not yet mandatory at 30 June 2027. Pentagram Advisory's Enhanced CIRMP Readiness Assessment Module provides a structured and efficient way to assess and explain your Enhanced Rules readiness. Contact pentagramadvisory.com.au

This video explores the Albanese Labor Government's agenda, from 2023 to 2026, to change the discussion about superannuation funds holdings from compulsory investments that must deliver maximum financial benefit to the fund holders to be used as a source of capital to use, in the 'national interest', to fund the Labor Government's policies and ideological programs. This is tantamount to nationalising those superannuation funds.

What does “suitable” really mean for a critical worker under section 9A of the Enhanced CIRMP Rules 2026? In this episode, Marina Shteinberg and Tim Slattery explore who makes the suitability decision, who owns the risk, and how ongoing assurance should work in practice . We examine the three pathways to critical component access — AusCheck plus the responsible entity’s suitability assessment, a relevant NV1+ security clearance, and the CIRMP risk-managed pathway — and explain what each pathway establishes, who makes the key decisions, and what responsibility remains with the organisation. We also look at ongoing suitability, the relationship with insider threat capability, and practical implementation outcomes for organisations preparing for the enhanced personnel security requirements under section 9A.

Oztopia: Academia explores the behaviour of some Australian academics and higher learning institutions who choose to collaborate with academia hostile states including China, Russia and Iran. The behave this way in the face of threat and risk advice from the Australian Government and its key agencies ASIO, DFAT, Defence and Home Affairs. Such academic collaboration can present risk to Australia's national security. I believe this academics are collaborating with the enemy.

In this episode, Tim Slattery and Marina Shteinberg, Co-Founders and Directors of Pentagram Advisory , unpack the personnel security implications of section 9A of the Enhanced CIRMP Rules 2026 and what responsible entities should prioritise ahead of the 10 June 2027 and 10 June 2028 implementation milestones . They explore how section 9A strengthens expectations around access management, critical worker identification and suitability, ongoing personnel assurance and workforce lifecycle security . The discussion also looks at why implementation should begin with risk, how to think about the two layers of access — to the critical infrastructure asset and to critical components — and why organisations need to connect people, roles, access, suitability and assurance within a coherent enterprise personnel security architecture. The episode concludes with a broader question of trust: how organisations can build appropriate assurance around the trust they grant to employees, contractors and third parties with access to their most critical assets, systems and information — their organisational “crown jewels”.

How much of what we judge to be a material security risk is driven by evidence — and how much by what we can most easily remember? In this episode, Tim Slattery and Marina Shteinberg of Pentagram Advisory explore the availability heuristic and what behavioural science can teach us about security risk management and decision making under uncertainty. In an era of heightened uncertainty, Boards, executives and security leaders are required to make consequential decisions with information that may be incomplete, uneven or constantly changing. Recent incidents, personal experience and highly visible threats can quickly dominate attention — while less familiar but potentially material risks remain outside the spotlight. Tim and Marina examine how availability bias can influence security risk assessment, risk prioritisation and investment decisions, and why a formal risk management framework does not remove human judgement — it structures where that judgement is exercised. They also consider practical ways to strengthen decision-making through broader evidence, structured challenge and greater transparency around the reasoning behind risk ratings. Because what is memorable is not necessarily what is material. And unfamiliarity is not evidence of safety.

What does employee engagement tell us about the strength and resilience of an organisation? Drawing on findings from Gallup’s State of the Global Workplace 2026 , Tim Slattery and Marina Shteinberg, Co-Founders of Pentagram Advisory , examine the latest Australian employee engagement data and explore what it may tell us about the relationship between employees and their workplaces. The discussion moves beyond traditional questions of productivity and retention to consider the connections between engagement, trust, the psychological contract and organisational culture — and what these may mean for security. Organisations can mandate policies, implement controls and monitor compliance. But security also depends on people exercising judgement, speaking up, taking ownership and acting when circumstances demand more than compliance. We can mandate compliance. We cannot mandate care. This episode explores why that distinction matters for Boards, executives, security leaders and people leaders — and why employee engagement should also be considered through the lens of organisational resilience and security. Source: Gallup, State of the Global Workplace 2026

How is artificial intelligence changing the insider threat landscape—and how should organisations respond? In this special episode from Pentagram Advisory , Tim Slattery and Marina Shteinberg , Directors and Co-Founders of Pentagram Advisory, are joined by Dr Jon Roginski , Founder and CEO of QualQuantAnalytics (Q2A) , for an in-depth conversation about insider threat, artificial intelligence, advanced analytics and the rapidly evolving relationship between people and technology. Jon brings more than two decades of experience across the U.S. military, academia and insider threat research, including leading the West Point Insider Threat Program research effort supporting the U.S. Army Insider Threat Program. He is also the creator of Managing Insider Risk and Organizational Resilience (MIROR) and a longstanding collaborator and friend of Pentagram. Drawing on this experience, Jon explores how organisations can make better use of increasingly complex data environments to create what he describes as a “decision advantage” —using AI-enabled data science, operations research, network science and applied analytics to support better-informed decision-making. The conversation moves beyond the technology itself to some of the more difficult questions emerging as AI becomes embedded in organisations: Can AI truly be controlled? How should organisations manage systems whose behaviour cannot always be perfectly predicted? What safeguards are required? And what happens when we begin to consider AI through the same risk lens traditionally applied to human insiders? Jon, Tim and Marina explore the distinction between control and management , the importance of observing, interrupting, correcting and recovering when systems behave unexpectedly, and the parallels between managing AI risk and established approaches to personnel security and insider threat. The discussion also considers what these developments mean for critical infrastructure, personnel security, trusted workforce programs, organisational resilience and security decision-making . Our sincere thanks to Dr Jon Roginski for joining Pentagram from the United States and for generously sharing his expertise, experience and perspectives with our community. Featuring: Dr Jon Roginski — Founder & CEO, QualQuantAnalytics (Q2A) Tim Slattery — Director & Co-Founder, Pentagram Advisory Marina Shteinberg — Director & Co-Founder, Pentagram Advisory Pentagram Advisory works with organisations to strengthen critical infrastructure security, personnel security, insider threat management, trusted workforce programs, supply chain security, security governance and organisational resilience. #InsiderThreat #ArtificialIntelligence #AI #JonRoginski #QualQuantAnalytics #PentagramAdvisory #PersonnelSecurity #TrustedWorkforce #CriticalInfrastructure #InsiderRisk #OrganisationalResilience

Australia is in decline. The nation is being attacked internally and externally by people and nation states who want to see Australia diminished, enfeebled. I want to stop that decline. I want to see Australia grow more prosperous, more socially cohesive and respectful, more secure. In this article I describe the Australia I want and suggest how those of us who support the idea of Australia as our home can work towards achieving that. I call it 'Oztopia'.

The Enhanced CIRMP Rules 2026 introduce a significant uplift in supply chain security requirements for affected critical infrastructure entities. In this episode, Tim Slattery and Marina Shteinberg from Pentagram Advisory unpack section 10A and explore the shift from traditional supply chain risk management towards critical dependency assurance . We examine what organisations may need to map, the distinction between major suppliers and dependencies supporting critical components, how deeply supply chains should be mapped, and the challenges involved in determining Maximum Acceptable Outage (MAO) . We also explore major-supplier assessment and Foreign Ownership, Control or Influence (FOCI) , the intersection between supply chain dependencies and critical worker obligations , and the practical implementation questions responsible entities should be considering as they prepare for the 10 June 2028 implementation deadline. The central question is no longer simply: Who are our suppliers? It is: What does our critical infrastructure asset depend upon, where do those dependencies sit, and do we have sufficient assurance and resilience to manage the resulting risk?

Welcome to Pentagram Advisory’s article and podcast titled In the National Interest: Australian Citizenship in Disarray. Pentagram’s ‘In the National Interest’ series explores issues that are strategic in nature. The issues are relevant to Australia’s critical infrastructure entities because they operate within Australia’s society and economy. Further, this series is relevant to any entity or person in Australia because the issues explored are national security matters and risks that are relevant to any individual person, to workforces, to private and public sector entities, to Australia’s society, its national security and resilience. In this article we will explore some of the issues facing the ‘idea’ of Australia citizenship in 2026. We find, as we explore the situation today, that Australian citizenship is undervalued and under attack.

Four diverse and significant insider threat events reported in one day: Origin Energy, Royal Australian Navy, U.S. Secret Service, and OpenAI.

The Enhanced CIRMP Rules 2026 introduce 78 additional legislative obligations for responsible entities, but implementation requires far more than updating an existing Critical Infrastructure Risk Management Program (CIRMP). In this episode, Tim and Marina introduce a practical framework for implementing the Enhanced CIRMP Rules by distinguishing between CIRMP maturity and organisational readiness . They explain why organisations should build on the governance, risk management processes and security controls already established under their existing CIRMP, rather than treating the Enhanced Rules as a separate compliance exercise. Using the relationship between sections 9 and 9A as a practical example, they explore how organisations can determine what should be retained, validated, strengthened, expanded or newly implemented, while developing structured implementation roadmaps aligned to the 10 June 2027 and 10 June 2028 legislative milestones. Whether you are a Board member, executive, security leader or CIRMP practitioner, this episode provides a practical methodology for moving beyond compliance and implementing the Enhanced CIRMP Rules in a structured, evidence-based and defensible way. This podcast is brought to you by Tim Slattery and Marina Shteinberg from Pentagram Advisory , helping Australia's critical infrastructure organisations strengthen governance, build resilience and achieve practical compliance with the Security of Critical Infrastructure Act.

The criminal charges against former Australian Defence Force (ADF) soldier Kira Korolev have been upgraded from “preparing for an espionage offence” to “conspiracy to commit espionage”. Pentagram's podcast set outs the public advice on the upgraded espionage charge Korolev and her husband now face, then explores the significance of Korolev, as an ADF member who would have been subject to significant background checks and security vetting to gain entry into the ADF, being charged with espionage. Further, the ADF and Defence have longstanding and mature personnel security programs, yet failed prevent Korolev's insider threat behaviour. The Australian private sector, including critical infrastructure entities, does not have personnel security systems in place that approach the maturity of the ADF's approach. That is the core of the issue the Korolev case presents: how can critical infrastructure mitigate the insider threat with underdeveloped and generally immature systems.

The Enhanced CIRMP Rules 2026 introduce the most significant expansion of Australia's Critical Infrastructure Risk Management Program (CIRMP) framework since its inception. But beyond the additional legislative obligations lies a more important question: what do these changes reveal about the future direction of Australia's critical infrastructure regulation? In this episode, Tim Slattery and Marina Shteinberg from Pentagram Advisory examine how the Enhanced CIRMP Rules 2026 signal a shift from demonstrating compliance to demonstrating organisational security capability. They discuss why Boards and senior executives should view the implementation period as a strategic opportunity to strengthen governance, build integrated security capability and prepare for future assurance obligations—not simply another compliance exercise. Drawing on Pentagram Advisory's detailed analysis of the Baseline and Enhanced CIRMP frameworks, this episode explores the key implementation timeframes, the evolving regulatory expectations, and why organisational readiness has become just as important as organisational maturity. This is the first episode in a new series examining the Enhanced CIRMP Rules 2026. Future episodes will explore the enhanced personnel security, supply chain security, cyber and information security, and physical security requirements, together with practical approaches to implementation. For more information, visit https://pentagramadvisory.com.au/

Why do so many capable and experienced leaders underestimate insider threat within their own organisations? In this episode, Tim Slattery and Marina Shteinberg from Pentagram Advisory explore the psychology behind the "Not In My Organisation" (NIMO) mindset—a common but often overlooked leadership blind spot that can prevent organisations from recognising and addressing insider risk. Drawing on research from the UK National Protective Security Authority (NPSA) and Dr Michael Robinson's analysis of real-world insider threat cases, the discussion examines why insider threat is frequently viewed as a problem that happens elsewhere, despite evidence demonstrating that it affects organisations of all sizes, sectors and levels of seniority. The episode explores seven psychological drivers that contribute to insider threat complacency, including optimism bias, availability bias, the trust heuristic, identity protection, assumptions about the psychological contract, the trust-versus-mistrust fallacy, and overconfidence in existing controls. Tim and Marina also discuss the meaning of trust in organisations, the relationship between trust and assurance, and why effective insider threat and trusted workforce programs are not built on suspicion, but on a mature understanding of human behaviour, changing circumstances and organisational resilience. Most importantly, the episode provides practical guidance for leaders seeking to move beyond the NIMO mindset, including: • Reframing insider threat as a human risk issue • Balancing trust with assurance • Treating workforce security as a leadership responsibility • Building multidisciplinary governance • Adopting a trusted, risk-based and proportionate workforce approach Whether you are a Board member, senior executive, security leader, risk professional or critical infrastructure practitioner, this episode offers a fresh perspective on one of the most misunderstood aspects of organisational security. Learn more about Pentagram Advisory: 🌐 https://pentagramadvisory.com.au/ Watch our videos and subscribe to our channel: ▶️ https://www.youtube.com/channel/UCrzs0YCDpPwNzqytwF7uoSg #InsiderThreat #HumanRisk #TrustedWorkforce #CriticalInfrastructure #PersonnelSecurity #RiskManagement #SecurityCulture #Leadership #InsiderRisk

Pentagram's case study of U.S. citizen Jareh Sebastian Dalke who worked the the National Security Agency and became an insider threat there. He stole top secret information and tried to sell that information to Russia.

If you are fascinated by Harry Potter, psychology, human behaviour, and the complex realities of protective security — this episode is for you. What do Harry Potter and insider threat have in common? More than you might think. In this episode, Tim Slattery and Marina Shteinberg from Pentagram Advisory explores the surprisingly sophisticated insider threat lessons hidden within the world of Hogwarts — from coercion and radicalisation to manipulation, identity compromise, disgruntlement, behavioural change, and the psychology of trust. Through characters such as Professor Quirrell, Ginny Weasley, Draco Malfoy, Kreacher, Barty Crouch Jr, Madam Rosmerta, Peter Pettigrew, and Severus Snape, we examine how human vulnerability, emotional pressure, ideology, coercion, and organisational culture can quietly undermine even the most protected environments. This is not simply a conversation about fiction. It is a discussion about modern protective security, insider threat, human behaviour, workforce resilience, and the growing importance of psychologically informed security programs in today’s critical infrastructure and organisational environments. Whether you are a Harry Potter fan, security professional, risk practitioner, psychologist, HR leader, or simply fascinated by human nature, this episode offers a unique and thought-provoking lens on one of the most complex challenges facing organisations today: the human factor. Because beneath the magic, J.K. Rowling was never really writing about spells. She was writing about us.

In this episode, Tim Slattery and Marina Shteinberg from Pentagram Advisory explore what the recently updated CIRMP annual reporting form may reveal about the evolving expectations of the Department of Home Affairs surrounding governance, operational resilience, assurance, and Board accountability under the Security of Critical Infrastructure Act 2018 . The discussion examines the broader shift from compliance-focused attestation toward evidence-based assurance, including what the expanded reporting requirements may mean for Boards, senior executives, and responsible entities preparing for the FY2025–26 CIRMP reporting cycle.

When employees leave, it is often treated as a process — access removed, systems closed, the relationship ended. But for people, it is a moment of change. A shift in identity, status and direction — shaped by how that experience is perceived. At the same time, for organisations, this is often when risk is most concentrated. Knowledge remains. Relationships continue. And control begins to reduce. So what really happens to trust at the point of exit? In this episode, Tim Slattery and Marina Shteinberg from Pentagram Advisory explore why exit and post-employment risk are often overlooked — and why how organisations manage people at this moment can shape what happens next.