In Australia’s National Interest - Security of Critical Infrastructure

Australia is in decline. The nation is being attacked internally and externally by people and nation states who want to see Australia diminished, enfeebled. I want to stop that decline. I want to see Australia grow more prosperous, more socially cohesive and respectful, more secure. In this article I describe the Australia I want and suggest how those of us who support the idea of Australia as our home can work towards achieving that. I call it 'Oztopia'.

The Enhanced CIRMP Rules 2026 introduce a significant uplift in supply chain security requirements for affected critical infrastructure entities. In this episode, Tim Slattery and Marina Shteinberg from Pentagram Advisory unpack section 10A and explore the shift from traditional supply chain risk management towards critical dependency assurance . We examine what organisations may need to map, the distinction between major suppliers and dependencies supporting critical components, how deeply supply chains should be mapped, and the challenges involved in determining Maximum Acceptable Outage (MAO) . We also explore major-supplier assessment and Foreign Ownership, Control or Influence (FOCI) , the intersection between supply chain dependencies and critical worker obligations , and the practical implementation questions responsible entities should be considering as they prepare for the 10 June 2028 implementation deadline. The central question is no longer simply: Who are our suppliers? It is: What does our critical infrastructure asset depend upon, where do those dependencies sit, and do we have sufficient assurance and resilience to manage the resulting risk?

Welcome to Pentagram Advisory’s article and podcast titled In the National Interest: Australian Citizenship in Disarray. Pentagram’s ‘In the National Interest’ series explores issues that are strategic in nature. The issues are relevant to Australia’s critical infrastructure entities because they operate within Australia’s society and economy. Further, this series is relevant to any entity or person in Australia because the issues explored are national security matters and risks that are relevant to any individual person, to workforces, to private and public sector entities, to Australia’s society, its national security and resilience. In this article we will explore some of the issues facing the ‘idea’ of Australia citizenship in 2026. We find, as we explore the situation today, that Australian citizenship is undervalued and under attack.

Four diverse and significant insider threat events reported in one day: Origin Energy, Royal Australian Navy, U.S. Secret Service, and OpenAI.

The Enhanced CIRMP Rules 2026 introduce 78 additional legislative obligations for responsible entities, but implementation requires far more than updating an existing Critical Infrastructure Risk Management Program (CIRMP). In this episode, Tim and Marina introduce a practical framework for implementing the Enhanced CIRMP Rules by distinguishing between CIRMP maturity and organisational readiness . They explain why organisations should build on the governance, risk management processes and security controls already established under their existing CIRMP, rather than treating the Enhanced Rules as a separate compliance exercise. Using the relationship between sections 9 and 9A as a practical example, they explore how organisations can determine what should be retained, validated, strengthened, expanded or newly implemented, while developing structured implementation roadmaps aligned to the 10 June 2027 and 10 June 2028 legislative milestones. Whether you are a Board member, executive, security leader or CIRMP practitioner, this episode provides a practical methodology for moving beyond compliance and implementing the Enhanced CIRMP Rules in a structured, evidence-based and defensible way. This podcast is brought to you by Tim Slattery and Marina Shteinberg from Pentagram Advisory , helping Australia's critical infrastructure organisations strengthen governance, build resilience and achieve practical compliance with the Security of Critical Infrastructure Act.

The criminal charges against former Australian Defence Force (ADF) soldier Kira Korolev have been upgraded from “preparing for an espionage offence” to “conspiracy to commit espionage”. Pentagram's podcast set outs the public advice on the upgraded espionage charge Korolev and her husband now face, then explores the significance of Korolev, as an ADF member who would have been subject to significant background checks and security vetting to gain entry into the ADF, being charged with espionage. Further, the ADF and Defence have longstanding and mature personnel security programs, yet failed prevent Korolev's insider threat behaviour. The Australian private sector, including critical infrastructure entities, does not have personnel security systems in place that approach the maturity of the ADF's approach. That is the core of the issue the Korolev case presents: how can critical infrastructure mitigate the insider threat with underdeveloped and generally immature systems.

The Enhanced CIRMP Rules 2026 introduce the most significant expansion of Australia's Critical Infrastructure Risk Management Program (CIRMP) framework since its inception. But beyond the additional legislative obligations lies a more important question: what do these changes reveal about the future direction of Australia's critical infrastructure regulation? In this episode, Tim Slattery and Marina Shteinberg from Pentagram Advisory examine how the Enhanced CIRMP Rules 2026 signal a shift from demonstrating compliance to demonstrating organisational security capability. They discuss why Boards and senior executives should view the implementation period as a strategic opportunity to strengthen governance, build integrated security capability and prepare for future assurance obligations—not simply another compliance exercise. Drawing on Pentagram Advisory's detailed analysis of the Baseline and Enhanced CIRMP frameworks, this episode explores the key implementation timeframes, the evolving regulatory expectations, and why organisational readiness has become just as important as organisational maturity. This is the first episode in a new series examining the Enhanced CIRMP Rules 2026. Future episodes will explore the enhanced personnel security, supply chain security, cyber and information security, and physical security requirements, together with practical approaches to implementation. For more information, visit https://pentagramadvisory.com.au/

Why do so many capable and experienced leaders underestimate insider threat within their own organisations? In this episode, Tim Slattery and Marina Shteinberg from Pentagram Advisory explore the psychology behind the "Not In My Organisation" (NIMO) mindset—a common but often overlooked leadership blind spot that can prevent organisations from recognising and addressing insider risk. Drawing on research from the UK National Protective Security Authority (NPSA) and Dr Michael Robinson's analysis of real-world insider threat cases, the discussion examines why insider threat is frequently viewed as a problem that happens elsewhere, despite evidence demonstrating that it affects organisations of all sizes, sectors and levels of seniority. The episode explores seven psychological drivers that contribute to insider threat complacency, including optimism bias, availability bias, the trust heuristic, identity protection, assumptions about the psychological contract, the trust-versus-mistrust fallacy, and overconfidence in existing controls. Tim and Marina also discuss the meaning of trust in organisations, the relationship between trust and assurance, and why effective insider threat and trusted workforce programs are not built on suspicion, but on a mature understanding of human behaviour, changing circumstances and organisational resilience. Most importantly, the episode provides practical guidance for leaders seeking to move beyond the NIMO mindset, including: • Reframing insider threat as a human risk issue • Balancing trust with assurance • Treating workforce security as a leadership responsibility • Building multidisciplinary governance • Adopting a trusted, risk-based and proportionate workforce approach Whether you are a Board member, senior executive, security leader, risk professional or critical infrastructure practitioner, this episode offers a fresh perspective on one of the most misunderstood aspects of organisational security. Learn more about Pentagram Advisory: 🌐 https://pentagramadvisory.com.au/ Watch our videos and subscribe to our channel: ▶️ https://www.youtube.com/channel/UCrzs0YCDpPwNzqytwF7uoSg #InsiderThreat #HumanRisk #TrustedWorkforce #CriticalInfrastructure #PersonnelSecurity #RiskManagement #SecurityCulture #Leadership #InsiderRisk

Pentagram's case study of U.S. citizen Jareh Sebastian Dalke who worked the the National Security Agency and became an insider threat there. He stole top secret information and tried to sell that information to Russia.

If you are fascinated by Harry Potter, psychology, human behaviour, and the complex realities of protective security — this episode is for you. What do Harry Potter and insider threat have in common? More than you might think. In this episode, Tim Slattery and Marina Shteinberg from Pentagram Advisory explores the surprisingly sophisticated insider threat lessons hidden within the world of Hogwarts — from coercion and radicalisation to manipulation, identity compromise, disgruntlement, behavioural change, and the psychology of trust. Through characters such as Professor Quirrell, Ginny Weasley, Draco Malfoy, Kreacher, Barty Crouch Jr, Madam Rosmerta, Peter Pettigrew, and Severus Snape, we examine how human vulnerability, emotional pressure, ideology, coercion, and organisational culture can quietly undermine even the most protected environments. This is not simply a conversation about fiction. It is a discussion about modern protective security, insider threat, human behaviour, workforce resilience, and the growing importance of psychologically informed security programs in today’s critical infrastructure and organisational environments. Whether you are a Harry Potter fan, security professional, risk practitioner, psychologist, HR leader, or simply fascinated by human nature, this episode offers a unique and thought-provoking lens on one of the most complex challenges facing organisations today: the human factor. Because beneath the magic, J.K. Rowling was never really writing about spells. She was writing about us.

In this episode, Tim Slattery and Marina Shteinberg from Pentagram Advisory explore what the recently updated CIRMP annual reporting form may reveal about the evolving expectations of the Department of Home Affairs surrounding governance, operational resilience, assurance, and Board accountability under the Security of Critical Infrastructure Act 2018 . The discussion examines the broader shift from compliance-focused attestation toward evidence-based assurance, including what the expanded reporting requirements may mean for Boards, senior executives, and responsible entities preparing for the FY2025–26 CIRMP reporting cycle.

When employees leave, it is often treated as a process — access removed, systems closed, the relationship ended. But for people, it is a moment of change. A shift in identity, status and direction — shaped by how that experience is perceived. At the same time, for organisations, this is often when risk is most concentrated. Knowledge remains. Relationships continue. And control begins to reduce. So what really happens to trust at the point of exit? In this episode, Tim Slattery and Marina Shteinberg from Pentagram Advisory explore why exit and post-employment risk are often overlooked — and why how organisations manage people at this moment can shape what happens next.

Insider threat is the misuse by a trusted person of privileged access to, or influence over, assets and operations. The trusted person’s actions may be unintentional, or their actions may be intentional. In either instance the harm caused can be the same. But to become an ‘insider’ a person has to be granted admission. Australian media reported in April 2026 that an employee of the New South Wales Treasury had been charged for allegedly downloading over five thousand government documents. In this podcast, Pentagram recounts the public information about the case and explores insider threat issues which the case highlights.

Insider threat is the misuse by a trusted person of privileged access to assets and operations. The trusted person’s actions may be unintentional or they may be intentional. In either instance the harm caused can be the same. Organisations make a choice to grant trust to a person when they decide to employ them. But the pre-employment screening process is really a point-in-time security check which would reject candidates with any obvious security risk attributes. However, real risk occurs once a person is employed, is inside the organisation, and is often trusted by default. If an organisation does not have appropriate measures in place to observe and evaluate employees then they maximise the risk of insider threat activity. This risk is often exacerbated where organisations rely heavily on initial screening and trust-based models, without implementing mechanisms for continuous monitoring of behaviour and access. In such environments, abnormal activity may go undetected because there is no established baseline against which to assess deviations. In this podcast Pentagram Advisory explores the insider threat case of a lawyer employed by the New South Wales Director of Public Prosecutions.

In March 2026, the Commonwealth Government published the Independent Review of the Security of Critical Infrastructure Act 2018. The intent of the Review, conducted by Dr Jill Slay between November 2025 and January 2026, was to assess whether Australia's Security of Critical Infrastructure Act 2018 (SOCI Act) is achieving its intended objectives, functioning as intended, and is not producing unintended consequences. In this article, Pentagram Advisory Pty Ltd (Pentagram) will provide excerpts of the Review and also comment on components of the Review that Pentagram considers to be of most interest to Pentagram’s SOCI client entities and to our Community of Practice.

The recent fire at Viva Energy’s Geelong refinery has been widely reported as an industrial incident. But what does it reveal about Australia’s broader vulnerability when disruption occurs at nationally critical assets? In this episode, we move beyond cause and examine consequence — exploring how disruption to a single node in a highly concentrated and globally dependent system can have cascading effects across the economy. Ukraine has shown us what sabotage and disruption of critical infrastructure really look like. In the years leading up to Russia’s full-scale invasion in 2022, fires, explosions, cyber attacks and supply chain disruptions were often treated as isolated events — many ambiguous at the time, and later attributed to acts of sabotage linked to Russian state activity. What becomes clear, over time, is the pattern. Disruption rarely arrives as a single, decisive event — it emerges through a series of smaller incidents that only later form a recognisable and strategically significant pattern. Events like the Geelong refinery fire may be very different in nature — but they highlight how disruption at critical nodes can have broader consequences. Australia’s fuel system is not immune to these dynamics. In this episode, Tim Slattery and Marina Shteinberg from Pentagram Advisory examine what these patterns mean for Australia’s critical infrastructure — and why organisations must shift from a compliance mindset to one focused on assurance, resilience, and understanding their true points of vulnerability.

Insider risk rarely appears suddenly. In this episode, we explore why behavioural change is often the earliest warning signal — long before systems detect a problem. Learn how insider risk develops over time, how to recognise subtle behavioural indicators, and how organisations can respond early through human-centric approaches, strong culture, and proportionate action. Technology detects events. Behaviour reveals trajectories. The earliest signals of insider risk are not hidden in systems — they are visible in people. 🎧 Listen to understand how to recognise these signals earlier — and respond before risk becomes an incident. Brought to you by Pentagram Advisory Supporting organisations to strengthen resilience across insider threat, workforce security, and critical infrastructure protection.

This article explores the risks and consequence for Australia stemming from the 2026 war with Iran and resultant oil supply shock.

Why People Protect the Organisation What drives people to act in the organisation’s interest—especially when no one is watching? In this episode, we explore why security is not sustained by controls alone, but by human behaviour. We examine the role of intrinsic motivation, trust, and purpose in shaping security culture, and how these factors influence insider risk. Drawing on insights from workforce assurance and Trusted Workforce Programs, this discussion highlights how organisations can move beyond compliance to build environments where people choose to act responsibly. Because ultimately, security depends not just on systems—but on people. Presented by Pentagram Advisory Supporting organisations to strengthen security, resilience, and workforce assurance in complex environments. This podcast reflects insights gained through our work across Australia’s critical infrastructure sector, informed by collaboration with the SOCI community, ongoing research, and engagement with government.

Pentagram Advisory Pty Ltd invites you to watch and / or listen this recording of our recent article about the risks that war with Iran poses to Australia's critical infrastructure entities. Whilst critical infrastructure entity attack surfaces span a myriad of threat vectors, including cyber attacks, Pentagram's article focuses on the people component - those people employed within Australia's critical infrastructure entities as possible sources of harm. Iranian expatriates in Australia are of course especially vulnerable to Iranian government interference, coercion, and espionage. Australia, as a compassionate pluralist society, will see our first instinct be to offer assistance and protection to this group. But we must also appreciate that there is a risk, likely from a very few Iranians, that there could be insider threats, either coerced of volunteering to undertake acts of harm against Australia's critical infrastructure. We also must appreciate that Khamenei was not just head of the Iran theocracy, but was a global Shia leader and sponsor of terror. On that basis, non-Iranian Shia and anti-Westerners may also be aggrieved by Khamenei's assassination at the beginning of the war, and by the ongoing war. Such people may also be coerced or volunteer to cause harm in Australia. This is a challenging topic, rife for rendering by some people as a dog whistle for discrimination based on religious or ethnic affiliation. That can be one way to view this matter. Another way to view discussion about this threat is to admit to the reality that we have evidence of Iranian government acts that have, and continue to, intimidate Iranian expatriates living in Australia. Further, the Iranian Government has sponsored violence in Australia. And that was before the war! Do we ignore reality, and the increased likelihood of Iranian Government action against Australia (there are reports of increased cyber attacks from Iranian sources), or do we shy away from known and potential harms to Australia for fear of offending a small group of people? Remember, vanishingly few people will evolve to become pro-Iranian insider threats, more are likely to be coerced to act or volunteer to act. Either way, the harm is the same. To protect Australia's critical infrastructure, a key foundation of Australia's national security, leaders need to understand the reality of the threats we face and that requires the courage to engage with difficult challenges as explored in the article.