Cyber Voices

Australian Information Security Association (AISA)
  • 0.0 (0)
  • Technology
  • Updated Bimonthly

Welcome to CYBER VOICES, where we highlight and celebrate the diverse voices of the Australian cyber community. From top-ranking CISOs and government officials to threat hunters and vulnerability analysts, if there’s a voice to be heard, you’ll hear it on CYBER VOICES. Join us as we delve into the stories, insights, and expertise that shape the world of cybersecurity in Australia.

  1. 3d ago

    The Human Firewall: Darren Fleming on Staying Clear Headed in a Crisis

    Every playbook and SOP you have ever written assumes it will be picked up by a calm, fully regulated human. My guest this episode reckons that assumption is exactly where incident response quietly falls apart. Recorded live at AISA's inaugural CyberConnect Canberra 2026 at the Hotel Realm, David Savva-Willett sat down with Darren Fleming, peak performance strategist, author, and the man better known as That Mindfulness Bloke. Darren represented Australia in elite sailing, studied psychology and philosophy at Oxford, has written seven books on communication, leadership and mindset, sat in complete silence for ten days, and spent more than twenty years coaching global organisations including Caterpillar, Cisco, BHP and Rio Tinto on how to perform under pressure. His CyberConnect talk, The Human Firewall, covers the thing no runbook touches: what actually happens to a responder's brain in the first hours of a Sev1. They get into why the nervous system, not the playbook, makes the decision. How adrenaline and cortisol cut off access to long term memory, and why "it made sense at the time" is a physiological answer rather than an excuse. The difference between situational awareness, stretched awareness and tunnel vision, and why "I just didn't see it" keeps turning up in the debrief. Why incident teams start turning on each other under pressure, and why that is the body working exactly as designed rather than a culture problem. What ten days of Vipassana taught Darren that a psychology degree could not. The collapse of the average attention span from roughly two and a half minutes to under a minute in twenty years. How a SANFL club lifted its win rate by changing what three senior players did during the half time break. And the one technique Darren would hand a CISO heading into a tabletop next week. Find out more about Darren's work at thatmindfulnessbloke.com Cyber Voices is the official podcast of the Australian Information Security Association. Subscribe wherever you get your podcasts and leave us a five star rating, it genuinely helps others find the show. Learn more about AISA or become a member at aisa.org.au

    The Human Firewall: Darren Fleming on Staying Clear Headed in a Crisis

  2. Jul 22

    Earning the Chair: How Graham Fairley Became PEXA's CISO

    Most people arrive at the CISO chair from the outside. Graham Fairley did the opposite — he earned it from within. In this episode, host David Savva-Willett sits down with Graham Fairley, Chief Information Security Officer at PEXA (Property Exchange Australia), for a candid and personal conversation. Davey held the CISO role at PEXA before Graham, and the two have been friends and colleagues for the better part of a decade — which makes this a rare, honest look at what it actually takes to grow into one of the most demanding seats in Australian cyber. Graham progressed through identity and access management, security consulting and a security services lead role before stepping into the CISO chair in late 2024. Eighteen months in, he reflects on the learning curves nobody warns you about: winning executive and board buy-in, sitting with the weight of accountability, learning to let go of the technical work he loves, and becoming the kind of storyteller a modern security leader has to be. They also get into what PEXA actually protects — a platform underpinning Australia's ~$10 trillion property market and designated critical infrastructure — including the 6.5 million intrusion attempts PEXA blocked in a single financial year, four times the previous year's volume. Graham unpacks PEXA's layered defence approach, and the harder problem beyond the platform: the consumer. As he puts it, criminals don't need to compromise systems — they just need to compromise trust. In this episode: Why the "internal" route to CISO is undervalued — and the edge it gives youThe first 18 months in the chair, and the skills that sharpened fastestWhy every CISO has to be a storyteller (and where AI genuinely helps)Learning to step back so the team — not the CISO — becomes the heroDefending critical infrastructure at scale: layered controls, threat intel and speed-to-detectSocial licence, shared accountability and PEXA's Safeguarding Your Property Settlement white paperAI-supercharged business email compromise, and the "stop and think" habits that stop itReal advice for anyone who wants the CISO job one dayCyber Voices is the official podcast of the Australian Information Security Association (AISA). If you're enjoying the show, a five-star rating (about five seconds of your time) genuinely helps more people find it. Interested in sponsoring Cyber Voices or reaching the AISA community at CyberCon? Contact the AISA national events and sponsorship team via sponsorship@aisa.org.au. #CyberSecurity #CISO #AISA #CyberVoices #PEXA #CriticalInfrastructure #InfoSec #Leadership

  3. Jul 15

    Breachonomics Redux: Grant McKechnie on the Untold Cost of a Data Breach

    On this episode of Cyber Voices, host David Savva-Willett is on the ground at Canberra CyberConnect 2026, AISA's inaugural event in the nation's capital, sitting down with Grant McKechnie for a conversation that CFOs and board members need to hear. Grant is Managing Partner at Cyber Resilience Group and a two-decade CISO veteran of Endeavour Group, Telstra and NBN. He was named one of the top 10 CISOs in Asia Pacific in 2022 and has built greenfield cyber security functions across some of Australia's most critical infrastructure. Today at CyberConnect he has returned with Breachonomics Redux, a follow up to the passion project he has been researching for the past four years on the untold economic and human impacts of a data breach. We get into the share price data behind major Australian and global breaches, from Medibank's 198 days back to parity to Live Nation's share price actually climbing after a breach affecting 560 million records. Grant unpacks why the market is becoming ambivalent, why Australian penalties never match the crime, and why trust and communications have overtaken share price as the impact he now leads with when advising boards. We also dig into how threat actors are adapting (including calling the regulators on their own victims), why information sharing has quietly gotten worse even as we appear to share more, the three critical first hires when building a cyber function from a blank page, the underrated art of finding a board sponsor before you need one, and the crucial difference between what belongs in an ARC pack versus a full board pack.  If you have a CFO or a board member in your life, this is the one to forward on

    Breachonomics Redux: Grant McKechnie on the Untold Cost of a Data Breach

  4. Jul 8

    Rain, Hail or Shine: Chris Stannage on Cyber Run Club, Community and Mental Health

    This episode is a little bit different. Yes, my guest works in cyber security, but we are not here to talk about breach containment or zero trust architecture. We are here to talk about the people behind the industry and what it actually takes to show up and do this job sustainably. Chris Stannage is a Scottish born, Melbourne based Senior Account Executive at Illumio, a former competitive rugby player, and the founder of Cyber Run Club, a monthly gathering at the Tan that brings cyber professionals together for movement, fresh air and honest conversation with zero pressure and zero sales pitches. We chat about the lunch that sparked the whole idea, the strictly sales free ethos and why it works, the organic connections made along the way (including an analyst picking the brain of a CISO mid jog), mental health in our industry and why talking early matters, what competitive rugby taught Chris about teams and discipline, and his unlikely path from a microbiology degree to cyber sales. Cyber Run Club meets on the last Thursday of every month at the Tan in Melbourne. Walk, jog or run, everyone is welcome, from students to CISOs. Find the group by searching Cyber Run Club on LinkedIn. A note on mental health: our conversation is general in nature and we are not experts in this space. If anything in this episode raised something for you, support is available. Lifeline 13 11 14 or lifeline.org.au. Beyond Blue 1300 22 4636 or beyondblue.org.au.

  5. Jul 1

    Emily Holyoake on Security Culture, Human Risk and Canberra Roundabouts

    Recorded live at the inaugural Canberra CyberConnect 2026, David sits down with Emily Holyoake, Executive Director and co-founder of Not A Standard and one of the creators of the SAFE Framework, a multidisciplinary approach that brings cyber security, criminology and behavioural science together to map how adversaries exploit people, technology and systems. Emily is a proud Wurundjeri woman and a passionate advocate for neurodiversity in cyber. In this conversation, Emily unpacks the thinking behind one of the best titled talks on the program, Navigating Human Risk: What to Do When Your Security Culture Handles Like a Canberra Roundabout. She explains why great security culture is really a design problem, when you want people safely on autopilot and when you want them to slow down and think, and why phishing simulations so often do more harm than good. Along the way she makes the case that humans are our greatest asset rather than the weakest link, that looking after our people is the best defence against insider risk, and that we all need to be wrong more. Whether you are a new CISO building your first 30-day plan or you simply want to bring your security program back to the people it serves, this one is full of practical and genuinely human thinking. Please note this episode contains a brief reference to suicide. If anything in this episode affects you, support is available in Australia through Lifeline on 13 11 14 or at lifeline.org.au. If this conversation resonates with you, subscribe to Cyber Voices on your podcast app of choice and leave us a five-star review. It helps others find the show. Cyber Voices is the official podcast of the Australian Information Security Association (AISA).

    Emily Holyoake on Security Culture, Human Risk and Canberra Roundabouts

  6. Jun 24

    The Sword Cuts Both Ways: Professor Toby Walsh on AI, Mythos and the New Normal in Cyber

    On this episode of Cyber Voices, host David Savva-Willett is at Canberra CyberConnect 2026, AISA's inaugural event in the nation's capital, for a wide-ranging conversation with Professor Toby Walsh, one of the world's most influential voices in artificial intelligence. Toby is a Professor of AI at UNSW Sydney and Chief Scientist of UNSW AI. He has advised the United Nations and heads of state on the limits we need to place on AI, and his outspoken stance on the military uses of the technology famously earned him an indefinite ban from Russia. In this conversation, Toby and David dig into what AI really means for cyber defenders right now. They discuss Anthropic's Mythos and the wave of decades-old zero-day vulnerabilities now being uncovered, why this is the new normal rather than a one-off event, and how AI has democratised offensive capability so that sophisticated attacks no longer require deep technical expertise. They also explore the questions that matter most for security leaders: whether defenders are really losing the AI arms race, why dwell time has collapsed from 200 days to a smash-and-grab measured in hours, the rise of shadow AI arriving both top down and bottom up, the sovereignty risk when powerful tools are released only to a select few, and the lessons from the Canvas breach where attackers did not hack the front door, they simply logged in. Toby also lifts the lid on the ideas behind his latest book, The Shortest History of AI: Six Ideas Are All You Need to Know, including why AI is a 70-year overnight success and why the human brain, running on the power of a dim light bulb, still puts our most advanced machines to shame. Whether you are a CISO being asked to govern AI while still learning it yourself, or simply trying to separate the signal from the hype, this is a clear-eyed and occasionally very funny look at where AI and cyber security collide. Topics covered: Why AI is a double-edged sword for cyber, threat and defence at onceAnthropic's Mythos and the discovery of zero-day flaws nearly 30 years oldHow AI has lowered the barrier to entry for sophisticated attacksWhether defenders are losing the AI arms raceDwell time collapsing from 200 days to under two hoursShadow AI, and how security leaders can actually govern itSovereignty risk and the case for stronger regulationThe Canvas breach and the era of just logging inSix big ideas from The Shortest History of AI Cyber Voices is the official podcast of the Australian Information Security Association (AISA).

    The Sword Cuts Both Ways: Professor Toby Walsh on AI, Mythos and the New Normal in Cyber

  7. Jun 17

    When Everything Is On Fire: Shane Fitzsimmons on Leading Through Crisis

    Recorded live at CyberConnect Canberra 2026, Cyber Voices host David Savva-Willett sits down with Shane Fitzsimmons AO AFSM, Managing Director of SAF Leading Advisory, former Commissioner of the New South Wales Rural Fire Service and inaugural Commissioner of Resilience New South Wales. David grabbed Shane straight off the main stage, minutes after his opening keynote on leadership in unprecedented times. Few people understand leadership under sustained pressure the way Shane does. He led New South Wales through the Black Summer bushfires, the floods that followed, biosecurity threats, critical infrastructure incidents and a global pandemic. His message to a room full of cyber leaders is strikingly simple. No matter the crisis, we are all part of a people organisation, and people are the anchor. Across the conversation Shane and David explore why a security leader's most important job is translation, turning complex and jargon heavy detail into plain language that paints an accurate picture for the board and the community. They dig into leadership as a culture rather than the sole purview of the person at the top, why trust and shared values have to be banked in the quiet times before any siren sounds, and why the most powerful thing a leader can say in a crisis is "I don't know, but I will find out." Shane also shares hard won lessons on looking after people in sustained pressure roles, the kind of burnout that incident responders and volunteers know all too well, and his belief that professionalism has nothing to do with whether you are paid. The pair turn to resilience and the discipline of learning from others rather than waiting for the crisis to find you, the value of after action reviews that capture what went well and not just what went wrong, and the knowledge transfer that readies the next team to step up. He closes with a single piece of advice for any cyber leader walking into the boardroom in the middle of an incident. Listen, keep it real, drop the ego, and let people know you care. This is an episode for every level of a security team, and one worth sharing well beyond our industry. If it lands with you, subscribe to Cyber Voices on your favourite podcast app and leave us a five star review. Full show notes are in the episode description.

    When Everything Is On Fire: Shane Fitzsimmons on Leading Through Crisis

  8. Jun 10

    Turning Off the Tap: Andrew Haschka on AI, Vulnerabilities and the Software Supply Chain | GitLab

    In this episode of Cyber Voices, the official podcast of AISA, host David Savva-Willett is joined by Andrew Haschka, Field CTO for Asia Pacific and Japan at GitLab, for a candid look at the question almost every enterprise is wrestling with right now: how do we let developers move faster with AI without flooding production with vulnerabilities we cannot keep up with? With more than two decades across cyber security, cloud and digital transformation, and prior leadership roles at Google and VMware, Andrew advises organisations and governments across the region on delivering software securely and at speed. At the heart of the conversation is what Andrew calls the AI paradox. AI can make writing code dramatically faster, yet the flow on effects in testing, security validation, compliance and release often slow teams down, because the volume of code rises while the team stays the same size. Much of that AI generated code is drawn from the internet, where not everything is secure by design, so vulnerabilities can increase exponentially. Andrew and David explore the memorable goal of one CISO to turn off the tap of vulnerabilities running in production, and why prevention beats endless triage. From there the discussion moves to the consumerisation of AI and the sprawl of unmanaged tools, the importance of a traceable system of record that evolves into a knowledge graph, and the defender's advantage in the arms race between teams shipping AI assisted code and attackers using AI to find weaknesses. Andrew makes the case that a defender whose AI understands the specific code base, threat model and compliance posture will spot what a generic attacker AI misses. Andrew also unpacks what secure software supply chains look like in an AI assisted world, from integrity and attestation to provenance and traceability, and shares practical guidance for any security leader being asked to enable AI for their development teams. His advice centres on building intelligent orchestration across three layers: a unified data layer and system of record, strong control and access with purpose built agents, and a governed experience delivered through an AI gateway rather than uncontrolled sprawl, all with humans firmly in the loop. It is a practical and forward looking conversation for any CISO, engineering leader or developer trying to capture the benefits of AI without inheriting a new generation of risk.

    Turning Off the Tap: Andrew Haschka on AI, Vulnerabilities and the Software Supply Chain | GitLab
See All (80)

Trailer

About

Welcome to CYBER VOICES, where we highlight and celebrate the diverse voices of the Australian cyber community. From top-ranking CISOs and government officials to threat hunters and vulnerability analysts, if there’s a voice to be heard, you’ll hear it on CYBER VOICES. Join us as we delve into the stories, insights, and expertise that shape the world of cybersecurity in Australia.

Information

  • Creator
    Australian Information Security Association (AISA)
  • Years Active
    2024 - 2026
  • Episodes
    80
  • Rating
    Clean
  • Copyright
    © Copyright AISA
  • Show Website
    Cyber Voices

You Might Also Like