Article

If you are fascinated by Harry Potter, psychology, human behaviour, and the complex realities of protective security — this article is for you. Because beneath the magic, mythical creatures, and fantastical battles lies something surprisingly real: a sophisticated study of trust, manipulation, coercion, vulnerability, loyalty, radicalisation, and human risk. Long before organisations spoke so publicly […]

Recently, many critical infrastructure responsible entities covered by the Security of Critical Infrastructure Act 2018 (SOCI Act) are likely to have noticed a significant evolution in the annual Critical Infrastructure Risk Management Program (CIRMP) reporting process, with the FY2025–26 reporting cycle signalling a broader shift in regulatory expectations surrounding governance, resilience, and Board accountability. The revised annual reporting

Why exit and post-employment risk are the missing pieces in workforce assurance Listen to the audio version of this article below: Executive Summary For many organisations, workforce assurance begins at hiring. Significant effort is often invested in pre-employment screening, background checks, and initial suitability assessments. Increasingly, organisations are also strengthening their approach to ongoing suitability,

The fire at Viva Energy’s Geelong refinery should be treated as more than an industrial incident. Initial media reporting points to equipment failure stemming from inadequate maintenance. There is, as of 17 April 2026, no public evidence of sabotage. But focusing on cause alone risks missing the broader point. For operators of critical infrastructure — and for

Observing the absence of usual and the presence of unusual Introduction: The Illusion of Sudden Insider Risk Insider incidents are often described as unexpected. A data breach occurs. A policy is violated. Sensitive information is disclosed. The event appears sudden, and the question that follows is predictable: How did this happen? However, in most cases, the

Organisations responsible for protecting government resources or critical infrastructure assets have, over time, built increasingly sophisticated security architectures. Policies are codified, controls are implemented, monitoring capabilities are expanded, and compliance frameworks are strengthened. These mechanisms are necessary, and in many cases, highly effective. They provide structure, consistency, and a defensible basis for managing security risk