What 148 leaders and two rooms told us about AI

Over the last eight weeks we took CyberScape to Melbourne and then Sydney under one theme: Rewired by AI.

The idea behind the theme was simple. AI has changed what your organisation can do, what your attackers can do, and what your board is asking you. We wanted a day that dealt with all three honestly, with live capability on stage rather than slides, and with peers talking openly to each other.

Both days ran under the Chatham House Rule, so I won't attach names to anything said in the room. What I can share is what we learned, and some of the most useful insight came before anyone walked through the door.

When people registered, we asked them three short questions. 148 of the 153 security, technology and business leaders who registered across both cities answered, from customers and prospects through to our technology partners. It is a small sample, but it is a real one, and it tells a clearer story than most of the analyst numbers we see.

The headline for me is that 41% of these leaders say AI is already taking actions in their systems. Not drafting emails. Acting. At the same time, 46% are still at individual or team use. So the room was split almost down the middle, and the security conversation has to work for both groups at once.

Two things stood out. Only 7% said security owns AI, which means in most organisations the people who have to defend AI are not the people deciding on it. And nearly one in five said either every business unit is doing its own thing, or nobody owns it at all. Put that next to the 41% who already have AI acting in their systems and you can see where the risk is building.

Threats coming first was expected. What surprised me was the future of work, close behind at 63%. This was not a security audience asking only security questions. People want to understand what AI means for how their organisation works, and security is part of that answer rather than a separate conversation.

One in four also picked when cyber becomes physical: buildings, cameras and access that can think. Most cyber events don't touch it, and I think it will grow.

We built the panels to create honest disagreement rather than polite consensus. Each one put business, security and partner voices on the same stage. Cyera, Keepit and MyCISO also joined our panels in Melbourne.

We opened this panel on the registration data, so the room walked in already knowing the answer for their own organisation. The debate quickly moved past whether to use AI. That argument is over. The real tension was who is accountable when it goes wrong, who is allowed to say no, and who pays for it.

In most organisations, ownership is sitting in four or five places at once: the business unit that bought the tool, the CIO who inherited it, the CISO who has to defend it, and a risk team that found out afterwards.

The second panel moved the conversation into the boardroom: resilience, investment and accountability. Boards are asking sharper questions about AI than they were a year ago, and they want answers in business terms, not control frameworks. Having non security voices on this panel made a real difference. It is a very different conversation when the person asking is the one signing off the budget.

Our GRC session took on something almost everyone in the room recognised. Most organisations wrote an AI policy in the last eighteen months. Very few can evidence it. The sharpest point was third party risk: every vendor assessment completed before those vendors shipped AI features is now out of date, and most organisations have a lot of them. MyCISO ran this session in both cities, with Jason Ha, their CISO, presenting in Melbourne and Alexander Tso, Security Architect, presenting in Sydney.

The Platinum Exchange is the part of CyberScape I'm proudest of. No decks, no company overviews. Each partner gets one problem, shows one capability working live, and then takes a question from our host in front of the room. Melbourne's second Exchange summed up the whole program in one line: what AI can read, what it can destroy, and what stops it.

To close the day in Melbourne, our Chief Technology Officer Jeremy Paton and Chief Security Officer Chris Tiqui sat down for a fireside chat with Craig Lawton, Principal AI/ML Solutions Architect at AWS, with thanks to TD Synnex. Three people who see the same problem from different ends of it: the people building with AI, the people defending it, and the platform it runs on.

Here are the actions I would take first, shaped by the survey data and by what we heard in the room.

CyberScape only works because of the people in the room and the partners who lean in. Thank you to everyone who attended, to our panellists for being candid on stage, and to the partners below who made both days possible.

We will keep asking the people who register for CyberScape where they stand before they arrive. Over time that builds something nobody else in this market has: a real picture of how Australian organisations are changing, measured by the people doing the work.

If any of this is on your mind, I'm keen to hear how it looks in your organisation. I'm always happy to talk it through, and you can reach me through the links below.

Ferdinand Tadiaman, CEO, Nueva