Future Secured - Shaping a Future-Proof Digital Society

In this 50th episode of Future Secured, Sandro Bucchianeri, Chief Security Officer at National Australia Bank, takes us inside the uncomfortable reality of modern cybercrime: attackers operate with no boundaries, no legislation, and no regulators. They move fast, change partners instantly, and treat targets as simple commercial opportunities. 

On the other side are highly regulated organisations like banks, operating under SOCI, ASIC, APRA and ASD guidance, trying to defend customers, critical infrastructure and national confidence while navigating layers of governance, compliance and risk management.

Sandro contrasts the brutal simplicity of criminal negotiations, “What’s your cut? Yes or no?”, with the complexity defenders face when uplifting controls, coordinating across global teams and working with government, ASD and industry peers to share intelligence and respond to DDoS campaigns, phishing, ransomware and AI-driven threats. From his early motivation to “protect people from bad things happening” through to leading cyber and physical security at NAB, he unpacks why security fundamentals, collaboration and communication still decide who wins. 

Takeaways
- Cyber criminals don’t respect boundaries — they ignore legislation, regulators and ethics, and focus purely on speed, profit and opportunity.

- Criminal negotiations are fast and transactional — simple cuts, no paperwork, and instant switching to the next willing partner if you say no.

- Defenders operate in a regulated world, balancing SOCI, APRA, ASIC and ASD expectations with service uptime, customer trust and board accountability.

- Compliance is a by-product of good security — ticking boxes on frameworks alone does not make an organisation secure.

- Most major breaches still come back to basics — patching, privileged access, identity and access management, segregation of environments and backup discipline.

- Nation-level resilience depends on collaboration — banks, government and international partners sharing indicators of compromise, DDoS patterns and threat intelligence in real time.

- AI and automation are a double-edged sword — used by attackers to improve phishing, deepfakes and social engineering, and by defenders to scale detection, response and analysis.

- Security culture and education matter as much as tools — from frontline branch staff stopping scams to “security champions” and cyber awareness woven into everyday work.

- Building the talent pipeline starts early — Sandro argues for cyber as an extracurricular pathway in schools, uplifting marginalised youth and diverse talent into cyber roles.

- Resilience is personal as well as technical — faith, family, boundaries and perspective shape how leaders carry the constant pressure of defending at scale.

C

In this episode of Future Secured, Jason Murrell and Tom Finnigan are joined by David Gee, a renowned technology executive, author and cybersecurity board advisor, to reflect on how the role of cyber leadership has evolved from firefighting to business enablement. Drawing on his experience as CISO for HSBC Asia Pacific, Global Head of Tech and Cyber Risk at Macquarie and CIO across global markets, David shares practical lessons on navigating boardroom expectations, building cyber resilience and why focusing on the fundamentals matters more than ever today.

The discussion explores the real impact of AI and quantum computing on the cyber threat landscape, the psychology behind human error and how CISOs can move beyond fear-based messaging to influence change at the executive level. David also reflects on writing his book, A Day in the Life of a CISO, and what it taught him about the shared challenges across the industry, from burnout to boardroom dynamics.

Whether you're a cyber leader, CIO, or a founder navigating security as a business enabler, this conversation will leave you with insight into the biggest cyber challenges facing CIOs and CISOs right now.

Takeaways
- David Gee’s career spans over 25 years across global cybersecurity and technology leadership roles.
- The nature of cyber leadership has shifted from pure risk control to strategic business enablement.
- I and quantum are changing the rules; CISOs need to prepare now, not later.
- Culture and clear communication are critical, especially at the board level.
- Many breaches still come down to basic hygiene, patching, awareness, and visibility.
- CISOs must focus less on fear and more on building partnerships within the business.
- Writing his book revealed just how universal the pressures on cyber leaders really are.
- A portfolio career can be both intentional and deeply rewarding in later stages.
- There’s value in cross-pollination, applying CIO skills to CISO roles and vice versa.

Sound Bites
“You don’t need to scare the board, you need to educate them.”

“It’s not just tech, it’s people, it’s politics, it’s positioning.”

“We keep chasing the shiny tools, but basic cyber hygiene still matters most.”

“AI isn’t coming. It’s already here.”

Chapters
00:00 – Welcome and Introduction to David Gee
03:21 – David’s Career from CIO to CISO to Portfolio Advisor
06:12 – What David Learned Writing A Day in the Life of a CISO
10:45 – The Evolution of Cyber Risk and Board Communication
15:03 – Navigating the Post-COVID Acceleration of Threats
18:32 – AI, Automation and the Changing Threat Landscape
22:45 – Quantum Threats and Why Fundamentals Still Matter
26:58 – The Cyber Confidence Gap and Internal Politics
30:10 – Why Many Organisations Still Struggle with Basics
33:26 – Advice for Future Cyber Leaders and Career Transitions
36:54 – Final Reflections on Strategy, People and Purpose

In this episode of Future Secured, Sam Fariborz, Chief Information Security Officer at David Jones, joins Tom Finnigan and Jason Murrell and shares her journey from IT service management to leading cybersecurity for one of Australia’s most trusted retail brands.

Sam shares her view of the evolving role of the modern CISO, balancing protection with performance and security with seamless customer experience. She explains how values-driven leadership and human-centred culture have become the foundation of effective cyber strategy in complex business environments.

We find out how she leads teams through pressure, builds psychological safety and turns compliance into collaboration. Sam also highlights how AI and automation are changing threat landscapes, why mentorship and visibility matter for women in cyber and how returning to fundamentals, identity, access, and awareness, remains the best defence against evolving threats.

Whether you’re a security leader, aspiring CISO, or business executive, this episode packs in stories from Sam that offer practical lessons on resilience, decision-making, and the mindset needed to thrive in the ever-changing world of cybersecurity.

Takeaways
Sam transitioned from IT service management to leading cybersecurity at David Jones.

The CISO role is evolving from enforcement to enablement, aligning security with business outcomes.

Balancing risk, speed and customer experience defines cybersecurity in retail.

AI-driven threats are reshaping incident response, detection and automation.

Mentorship and visibility are vital for empowering women in cybersecurity.

Continuous learning builds both personal and organisational resilience.

Setting healthy boundaries prevents burnout in high-pressure roles.

Building trust and psychological safety drives effective team performance.

Cybersecurity fundamentals, patching, identity and access control, remain critical for resilience.

Values-based leadership turns security from a blocker into a business enabler.

Sound Bites
“You need to make decisions quick, especially when the clock is ticking.”

“It’s always a fine balance between security and business.”

“You have to switch off sometimes, resilience starts with rest.”

“Cybersecurity isn’t just about controls; it’s about culture.”

“If we do the fundamentals right, we’ve already gone a long way.”

Chapters
00:00 — Introduction to Sam Fariborz and her journey into cybersecurity
02:51 — The evolving role of the CISO in modern retail
05:21 — Balancing security and business operations
08:01 — Emerging cyber threats and AI-driven risks
10:52 — Building confidence and visibility for women in cybersecurity
13:30 — Leadership under pressure: managing burnout and boundaries
16:06 — Creating a culture of learning and psychological safety
18:45 — Governance that drives value, not paperwork
23:29 — Building resilience through fundamentals
26:23 — Mentorship, connection, and community in cybersecurity
28:56 — The human side of security: empathy, trust, and behaviour change
33:07 — Leading with values in complex environments
40:37 — Continuous learning and the future of cyber leadership

In this episode of Future Secured, Michael Gianarakis, Co-founder of Assetnote and now Chief Product Officer at Searchlight Cyber, unpacks the full startup journey: from bootstrapping a company in Australia to leading enterprise product strategy after a global acquisition.

With over 17 years in offensive security and a regular speaker at DEFCON, BSides, and Hack in the Box, Michael offers a practical view on building cybersecurity products that matter. He explains why Assetnote emerged from real customer demand, why they said no to VC funding, and how long-term success was built through trust, ruthless pragmatism, and outcome-driven execution.

We cover lessons in customer retention, product-market fit, AI in cybersecurity and managing the acquisition process. Michael also reflects on founding team dynamics, documenting processes for scale and staying focused when acquisition interest becomes a distraction.

Whether you’re a cybersecurity leader, founder, or product builder, this episode delivers concrete lessons for building and scaling technology that lasts.

Takeaways

- 17+ years from pen testing and red teaming to product leadership.
- AssetNote was built from customer feedback and real-world demand.
- Bootstrapping preserved control and optionality.
- Retention comes from trust, value, and workflow integration.
- AI is a tool, not a fad; outcomes beat hype.
- Acquisitions are resource-heavy but manageable with preparation.
- Strong, ego-free founding teams win over time.
- Documentation and lean processes smooth operations and diligence.
- Product-market fit = sell it, retain it, scale it.
- Ruthless pragmatism is a core operating principle.

Sound Bites
- “We didn't take any investment.”
- “Don't just blindly take advice.”
- “It's all about ruthless pragmatism.”

Chapters
00:00 — Introduction to Michael Gianarakis and AssetNote
02:40 — The Journey of Bootstrapping a Startup
05:23 — Navigating Investment Decisions and Growth
08:21 — Understanding Market Fit and Customer Validation
11:17 — The Decision to Sell: Timing and Considerations
13:57 — Lessons Learned from the Startup Journey
16:48 — Building Trust and Customer Relationships
19:45 — Creating Value and Retention in Cybersecurity Products
24:18 — Building Competitive Advantage in Security Products
25:10 — The Role of AI in Security
29:02 — Navigating the Acquisition Process
34:45 — The Dynamics of Co-Founders
42:08 — Scaling a Lean Startup
43:25 — Structuring a Successful Acquisition Deal

What does a world without passwords actually look like and how close are we?

In this episode of Future Secured, Karim Toubba, CEO of LastPass, explores the shifting future of password management, identity security and user authentication in an era defined by AI, Shadow IT and cloud-first business models. With over 25 years in cybersecurity leadership at companies like Cisco, Juniper Networks and Kenna Security, Karim shares how his journey from network engineering to the helm of LastPass has shaped his approach to building secure yet user-friendly solutions at scale.

We dive into how password managers are evolving into identity management platforms, the challenges of driving user adoption and cybersecurity education and how multi-factor authentication (MFA) and passkeys are reshaping the way organisations secure their digital identities. Karim explains why passwordless authentication will take time to reach critical mass in enterprise environments, even as consumer markets move faster and why businesses must prepare for a hybrid future where passwords and passkeys co-exist.

The discussion also tackles the risks of Shadow IT and Shadow AI, the need for SaaS visibility and policy-based controls and how incident response should be used as a learning loop to strengthen defences. Karim underscores the cultural and behavioural barriers to better security practices, arguing that education and prevention are critical if organisations want to reduce breaches and build lasting trust.

For the first time, Karim also shares insights about LastPass's cyber breach.

Whether you’re a CISO, SOC manager, or MSP supporting small businesses, this episode offers practical strategies to improve identity and access security while preparing for the next wave of authentication technology.

Key topics
Identity as the front door: user-to-app is the new perimeter; convenience and security must ship together.

Passwordless, realistically: consumer apps are moving faster than B2B; expect a hybrid of passwords + passkeys for the medium term.

Culture and tooling: adoption lags without user training and simple onboarding.

From consumer to business: prosumer habits seed enterprise rollouts; MSPs now bundle password managers to lift hygiene and reduce liability.

Shadow IT / Shadow AI: why SaaS visibility is step one, and how policy-based controls can monitor or block unapproved apps.

Learning from incidents: invest, communicate, improve, then keep going.

Chapters
00:00 Intro and Karim’s journey into cyber

02:26 Early security days: firewalls and the late-90s stack

04:45 Why LastPass; identity heats up again

06:53 User-to-app model, MFA, and convenience vs security

09:54 Consumer to enterprise: 70% B2B / 30% B2C.

12:56 Culture, basics and making MFA stick

14:50 SSO gaps, SSO “tax”, and where password managers fit

20:45 Passwordless in practice; storing passkeys and passwords together

22:25 Why B2C is adopting passkeys faster than B2B

25:07 Incident response and rebuilding stronger

35:26 Shadow IT/AI → SaaS monitoring and policy controls

38:59 Australia vs US: same problems, different rollout

43:09 Trust, simplicity and prevention

Quotes (sound bites)
“Authentication is one of the few security controls that’s front and centre to the user.”

“We’ll live in a co-mingled world, passkeys and passwords, for years.”

“Start with visibility, then fix the basics: unique credentials and MFA.”

Takeaways
Make it easy: remove friction, auto-fill, streamlined onboarding, and clear policies.

Train and nudge: simple, repeated prompts beat policy documents.
See first, then control: inventory SaaS usage; apply monitor → warn → block policies.
Plan for hybrid: support passkeys and passwords; let the vau

In this episode, Liz Morton, Field CISO at Axonius, shares her 25-year journey through IT and cybersecurity, including nearly a decade at the Intercontinental Exchange that looks after the New York Stock Exchange. She discusses the transition from practitioner to Field CISO, the persistent challenges of visibility and asset management and the reality behind the “cyber confidence gap.” Liz explains why remediation remains slow despite rapid detection, why fundamentals like MFA and patching still matter and how AI is reshaping security operations. The conversation explores cultural change, regulatory pressure and the importance of maximising existing investments before chasing new tools.

Takeaways
- Liz Morton’s career spans critical infrastructure, finance, and security leadership.
- Axonius helps organisations achieve visibility across assets, identities, and security controls.
- The “cyber confidence gap” reflects a disconnect between perceived and actual security posture.
- Fundamentals like MFA, patching, and identity hygiene remain the biggest vulnerabilities.
- Many organisations underutilise existing tools, leading to wasted spend and blind spots.
- AI offers speed and pattern recognition, but cannot replace core security processes.
- Cultural change is required at board and C-suite level to address risk realistically.
- Tool consolidation and efficiency are increasingly necessary as budgets tighten.
- Deepfakes and AI-powered attacks heighten the urgency of visibility and verification.
- The future of defence will focus on speed of detection, containment, and response.

Sound bites
“Everybody’s doing their best, but the fundamentals are still being missed.”
“You cannot secure what you cannot see.”
“AI is great at correlation, but it doesn’t excuse poor cyber hygiene.”

Chapters
00:00 – Introduction to Liz Morton and Axonius
02:20 – Transition from ICE to Field CISO role
05:30 – Common challenges across industries and budgets
09:00 – Visibility, asset management, and the Axonius platform
13:20 – Underutilised tools and the cost of tool sprawl
18:30 – Data noise, consolidation, and pragmatic cyber strategies
21:40 – Visibility in action: misconfigurations, zero days, and ROI
26:00 – Regulatory pressure and the return to fundamentals
30:00 – The persistence of basic attack vectors
32:30 – Identity, insider threats, and cultural change
36:00 – AI-powered attacks and deepfakes: new challenges
41:30 – The future of AI in security operations
46:00 – Closing thoughts and Liz’s upcoming visit to Australia

When cybercrime no longer respects borders, law enforcement must think globally too. In this episode of Future Secured, Tom Finnigan and Jason Murrell sit down with Mark Rysanek, the Cyber Liaison Officer for the Royal Canadian Mounted Police based in Sydney, Australia. Mark brings over a decade of front-line experience in cybercrime policing and now leads Canada's enforcement coordination across Oceania.

Together, they explore how cybercrime is evolving, from traditional tactics to AI-driven exploitation and why international cooperation is no longer optional. Mark shares how AI is disrupting police strategies at a faster rate than enforcement can keep up, the impact of insider threats, and the growing complexity of ransomware and digital currencies.

From the rising use of generative AI in child exploitation cases to the blurred line between prevention and prosecution, this episode is a candid look at how law enforcement is adapting under pressure and what needs to change before it’s too late.

💡 Key Takeaways
- Cybercrime is inherently transnational law enforcement must collaborate internationally.
- AI is accelerating faster than policing frameworks can adapt, especially in cybercrime.
- Ransomware is no longer a fringe issue; it’s central to modern criminal enterprises.
- Insider threats remain one of the most damaging and underestimated risks.
- Education and preventative efforts are more scalable than arrest-based enforcement.
- Digital currencies challenge traditional tracking and seizure of criminal funds.
- Policing is shifting from reactive to proactive, but cultural and legislative gaps remain.
- Private-public partnerships are critical to understanding and responding to fast-moving threats.
- Law enforcement needs new tools, policies, and mindsets to keep up with threat actors.
- The emotional toll on cybercrime investigators is real and increasing.

🧠 Soundbites
“Cybercrime doesn’t respect borders.”
“You can’t arrest your way out of a ransomware epidemic.”
“AI is moving faster than any law enforcement agency can track.”
“Digital currency is a game-changer for organised crime.”
“Private industry and government have to meet in the middle—we can’t work in silos.”

⏱️ Chapters
00:00 – Introduction to Cybercrime and Law Enforcement Collaboration
09:19 – Mark Rysanek’s Journey into Cyber Policing
18:07 – The Insider Threat: Real-World Cases and Law Enforcement Blind Spots
23:40 – AI’s Impact: Why It’s Redefining Cybercrime and Enforcement
36:33 – Ransomware Tactics: Evolution and Response Gaps
45:29 – Digital Currencies and the Shifting Financial Landscape
50:55 – Public-Private Partnerships: The Future of Cybercrime Strategy
54:17 – Final Reflections: The Emotional and Operational Demands of Policing Cyber

Guest: Will Baxter, Field CISO at Team Cymru
Hosts: Tom Finnigan & Jason Murrell

In this episode of Future Secured, we sit down with Will Baxter, a cyber veteran who began his career in the US Marine Corps and now serves as Field CISO for Team Cymru, a leading global threat intelligence firm.

From defending military networks to helping some of the world’s largest enterprises operationalise threat insights, Will brings hard-won wisdom from both the battlefield and the boardroom.

🔐 Topics covered in this episode:
- The transition from public to private sector cyber defence
- How threat actors are evolving, and why threat intelligence must too
- Why ransomware is still winning – and what most organisations are missing
- The psychology of insider threats and supply chain vulnerabilities
- The role of AI in both offence and defence
- How the basics of cyber hygiene still block the majority of threats
- Where market forces and regulation are heading – and what that means for cyber teams

💡 Key Takeaways

- Threat actors are innovating faster than many defenders.
- AI is now a tool used by both attackers and defenders.
- Despite hype, basic security practices still prevent most incidents.
- Insider threats can emerge from surprising places, including partners.
- We must stop outsourcing resilience: “Nobody’s coming to save us.”

🔊 Sound Bites

"The basics are still working, right?"
"Account takeover is a huge problem."
"Nobody's coming to save us."

⏱ Chapters
00:00 – Welcome and Introduction
01:56 – Will’s journey from Marine Corps to CISO
06:39 – Inside Team Cymru: What makes threat intel work
10:49 – Why ransomware is still a persistent threat
15:39 – Insider threats: People, partners, and problems
20:47 – Cyber hygiene: Still your best defence
24:44 – Cybersecurity and ROI: The value question
26:49 – Cryptocurrency and the evolution of scams
29:13 – Law enforcement and intelligence collaboration
31:45 – Why cyber education must evolve
32:37 – The future of threat intelligence sharing
38:29 – Market dynamics and regulation in cybersecurity

How do you protect a global research institution while embracing bleeding-edge tech like supercomputers, AI and even Bitcoin?

Dan Maslin, Group CISO at Monash University, returns to Future Secured to unpack what’s changed in cybersecurity across higher education and why universities are fast becoming some of the most complex security environments in the country.

In this episode, Dan explains how Monash is balancing rapid AI innovation with long-term resilience, shares insights into Australia’s tax and policy treatment of digital assets like Bitcoin, and explains why cyber leaders need to look beyond just tech to the psychology of trust, communication and leadership.

From ETF legitimacy for crypto to AI supercomputing in research, this is an unmissable conversation for CISOs, academics and cyber leaders navigating the next wave of change.

🔑 Takeaways

• Monash is building a genuine AI supercomputer, designed to fuel academic innovation and enterprise-grade performance.
• Digital assets like Bitcoin are gaining policy legitimacy, but there’s still confusion at the board and regulatory level.
• Cyber teams must adapt to rapid AI deployment, especially in research and marketing functions.
• Education on digital currency and AI is lagging, even within the university system.
• Wellbeing and mental health remain core leadership challenges, especially in high-trust, high-stakes environments.
• Australian cyber leaders need stronger global partnerships, and a more proactive policy stance on emerging technologies.

🧠 Soundbites

⏱️ Chapters

00:00 – Welcome back, Dan Maslin
 02:51 – What’s changed at Monash in the last 12 months
 06:30 – How AI is reshaping cybersecurity
 10:57 – Bitcoin, ETFs and digital asset legitimacy
 20:04 – Will traditional finance and crypto coexist?
 23:47 – The impact of AI on cyber job security
 26:40 – Real-world use cases for AI in research and advertising
 28:59 – What Australia needs to stay competitive
 36:05 – Why mental health is now a boardroom issue
 50:53 – Leadership, delegation and the need for self-reflection

In this episode, Vannessa Van Beek, Global CISO at Fortescue, joins Tom Finnigan and Jason Murrell to unpack what it takes to lead cyber security at the intersection of AI, mining, and innovation at scale.

She shares her unconventional journey to becoming CISO, her early adoption of AI inside security operations, and how Fortescue is using emerging tech to drive both resilience and cost-efficiency across its global footprint.

Vannessa opens up about leadership in high-pressure environments, the importance of psychological safety, and how tools like LEGO Serious Play help her team think more clearly, connect more deeply, and solve more complex problems, faster.

🔑 Key Takeaways
AI is already cutting incident response time, but trust and governance are still catching up.

The CISO role is evolving fast, especially in industrial environments like mining.

LEGO Serious Play helps break down silos and unlock team creativity.

Psychological safety is the foundation for innovation.

Great leadership often means asking better questions, not having all the answers.

The future of work is fluid: “Work doesn’t always happen at work.”

Creativity looks like frustration, but it’s where the breakthroughs are born.

AI isn’t a silver bullet—but it’s becoming as essential as electricity.

Insider threats and deepfakes are rising, but the real risk is misalignment with people.

🗣 Soundbites
“I stumbled across LEGO series play. It democratised the meeting.”
“Work doesn’t always happen at work.”
“AI is like electricity.”
“Creativity looks like frustration.”
“Psychological safety lets people speak their truth.”
“AI probably won’t replace your role, but someone using AI might.”

⏱ Chapters
00:00 – Intro: Mining, AI and Cyber security at Scale
02:55 – Vannessa’s Journey to CISO
06:04 – Using AI to Accelerate Incident Response
09:02 – Fortescue’s AI Strategy
12:04 – What AI Means for Cyber Leadership
14:54 – Redefining the CISO Role in 2025
18:03 – Psychology, Team Dynamics and Safety
20:56 – LEGO Serious Play in Cyber security Teams
24:04 – Creativity, Frustration and Flow State
27:03 – AI, Risk and Real-World Challenges
30:01 – The Future of Work and Human-AI Partnership
34:19 – Insider Risk, Deepfakes and Data Governance
40:00 – Final Reflections: Resilience and Adaptation