A cyber incident at a supplier can quickly become a disruption to your own operations. For Australian organisations, understanding these connections is an essential part of protecting services, managing risk and preparing an effective response.
The Australian Signals Directorate’s Annual Cyber Threat Report 2024–25 reported that its Australian Cyber Security Centre responded to more than 1,200 cyber security incidents, an 11% increase on the previous year. Critical infrastructure accounted for 13% of those incidents, highlighting the importance of protecting the suppliers, systems and services that support essential operations.
In our on-demand webinar, Achilles joins experts from Orpheus Cyber and Hall & Wilcox to explore how Australian organisations can strengthen cyber resilience through better supplier visibility, informed decisions and coordinated incident response.
The discussion highlights four practical steps.
- Understand where disruption could begin
Your cyber exposure extends to the suppliers that hold your data, connect to your systems or support essential operations. Identify which relationships would cause the greatest disruption if compromised. This helps procurement and security teams focus attention where the consequences would be most significant.
- Monitor how exposure changes
A supplier’s security position can change after onboarding. New vulnerabilities, exposed credentials and changes to systems can introduce risks that an earlier assessment would not capture. Combine supplier assessments with ongoing monitoring and threat intelligence to understand which exposures need attention. Engage suppliers early, agree corrective actions and follow through on progress.
- Prepare people to respond together
Even well-prepared organisations can experience a cyber incident. Resilience depends on how effectively they contain the impact, maintain essential services and recover. Bring technical, procurement, legal, communications and leadership teams together to rehearse realistic scenarios. Confirm who makes decisions, how suppliers will be involved and which customers or regulators may need to be notified. Prepare communications before the pressure of an incident makes those decisions harder.
- Give leadership information they can act on
Risk scores and technical alerts need business context. Leaders should understand what has changed, which operations could be affected and what action is being taken.
Assign clear responsibility for addressing findings and document decisions. For organisations covered by the Security of Critical Infrastructure Act 2018, connect this work to the specific risk management and reporting obligations that apply.
Watch our webinar on demand for practical insights into strengthening cyber resilience, managing supplier exposure and preparing your organisation to respond effectively.
