Top structural shifts set to reshape Australia’s critical systems

As Australia's critical infrastructure, industrial environments and connected enterprises continue their rapid digital evolution, the cyber-physical landscape is becoming more complex and more exposed than ever before. Threat actors are sharpening their focus on the invisible weak points created by sprawling device networks, fragmented vendor access, and globally interconnected supply chains.

In 2026, organisations across ANZ will shift from reactive cybersecurity to proactive resilience: strengthening visibility across every asset, tightening control over third-party access, and preparing for a new era of domestic cybersecurity innovation. Leon Poggioli outlines the three major trends that will shape how organisations defend, secure and future-proof their cyber-physical systems in the year ahead.

1. Organisations will prioritise having an accurate asset inventory

"You can't protect what you can't see" is a phrase that gets frequently thrown around in cybersecurity discussions. It sounds obvious, but "seeing" is no easy task when you're trying to protect a complex cyber-physical network containing thousands of OT, IoT, IIoT and BMS devices, making it a daunting task to create a comprehensive inventory. Every connected device, from a smart temperature sensor to an automated pump, is a potential entry point for a cyberattack – and it only takes one weak link to bring a chain down.

With the pace of digital transformation hitting lightning speed in recent years, it's been impossible for many organisations to keep up with all the new devices being connected to their networks, and cyber criminals are increasingly exploiting this vulnerability. Therefore, in 2026, we will see organisations place a greater focus on having an accurate asset inventory, so they can drive a more effective cybersecurity program overall.

2. Organisations will focus on supply chain cyber risk, while governments will increase opportunities for domestic cyber startups

In 2026, organisations will place greater focus on reducing their supply chain risk. It is no longer good enough for organisations to simply secure their own systems; they'll need to ensure their suppliers, vendors and technology partners meet the exact same security standards. In many cases, organisations wouldn't even know how many different third-party connections are in place, which creates a massive security blind spot. In fact, 46% of organisations said they've been breached in the past 12 months because of an issue with third-party access.  Next year, we will see organisations place a collective focus on reducing supply chain risk, which will help eliminate vulnerabilities across the board.

Meanwhile, we will see more opportunities for domestic cybersecurity startups as Australia enters the second phase of the 2030 Cyber Security Strategy. Specifically, the Federal Government will provide increased support for locally developed and controlled cybersecurity technologies, in order to reduce dependence on foreign technology and vendors, which can present national security risks. Developing a strong local cybersecurity industry ensures Australia is on track to become a world leader in cybersecurity and helps us defend against evolving, borderless cyber threats.

3. Organisations will take back ownership of secure remote access capabilities

For too long, critical infrastructure operators have granted a growing number of third-party vendors access to their networks without the proper visibility or security over this process. Traditionally, this remote access was gained via insecure VPNs, jump boxes and remote desktops, which unintentionally exposed organisations to a raft of vulnerabilities. 

Attackers have caught on to this growing risk and are increasingly targeting these insecure vendor-owned tools as a way to bypass an organisation's defences.

In 2026, we will see critical infrastructure operators clamp down on these blind spots and take back ownership over their secure remote access capabilities. Rather than allowing third-party vendors to connect using their own proprietary remote access methods, organisations will increasingly opt for "self-custody" over this process. This approach will mitigate third-party risk as organisations' operations become more digitised and interconnected, and threat actors become more brazen.