Conference program

Australia's critical infrastructure operators manage risk across four legislated hazard domains under the Security of Critical Infrastructure Act 2018 (SOCI Act) and Critical Infrastructure Risk Management Program (CIRMP): physical, cyber, personnel, and supply chain. The cyber domain increasingly benefits from mature intelligence practice, including threat feeds, dark web monitoring, and vulnerability analysis. The physical domain, across the broad majority of SOCI-regulated entities, does not. State actors conduct reconnaissance, activist campaigns map supply chains, and organised criminal networks surveil sites, all generating open-source and geospatial signals, yet most operators have no intelligence collection architecture, and in many cases no intelligence concept, applied to the physical threat domain.

Using a multiple case study methodology, the paper applies intelligence cycle analysis to four Australian incidents: organised gold theft in Western Australia, diesel supply chain disruption across NSW and South Australia, telecommunications infrastructure sabotage on the Mornington Peninsula, and repeated forced entry at Australia Post's Melbourne GPO. Each case reconstructs the attack timeline and identifies where observable precursors, including open-source signals, and geospatial anomalies, preceded the physical incident. Cross-case analysis reveals that in three failure cases, the intelligence cycle was absent as an operational construct, not merely broken at a single stage. Detection windows of one to four weeks existed but went unexploited. The contrasting case, a WA Police Gold Squad operation with an embedded intelligence function, produced a fundamentally different outcome.

Drawing on practitioner experience in critical infrastructure security and open-source intelligence, the paper proposes a scalable, intelligence-led collection framework that adapts established intelligence-led policing principles for organisations without dedicated intelligence units. The findings support embedding intelligence as a continuous operational function within CIRMP implementation, and identify critical infrastructure physical security as an emerging domain of intelligence practice.

In recent years, the cybercriminal supply chain has become a core part of the cybercrime ecosystem, enabling a wide range of online criminal activity and increasingly supporting real-world fraud. PwC Threat Intelligence has observed the continued distribution of stealer logs despite law-enforcement disruption, the growing use of phishing-as-a-service affiliate schemes, and an increasing reliance on initial access brokers to support ransomware, business email compromise, account takeover, and fraud. For organisations, the challenge is not simply understanding these activities, but in turning fragmented insight from the underground economy into actionable intelligence.

This presentation examines how organisations can leverage deep and dark web intelligence to make informed decisions on organisational strategy, operational activities, and risk management. It begins with a practical primer on the underground ecosystem, contextualising how information stealers, phishing kits, credential markets, underground forums, and initial access brokers interact across the attack lifecycle. It then draws on PwC Threat Intelligence global observations, including Australian stealer log exposures, access pricing trends, and targeting patterns, to show how these signals can be prioritised and interpreted in context.

A case study based on ransomware activity of the threat actor we track as White Veles traces the full attack chain: from credentials likely harvested by an infostealer and sold on an underground marketplace, to their purchase by a separate threat actor, subsequent access to the corporate environment, and ultimately ransomware deployment. Mapping each stage to observable indicators shows where organisations can detect, disrupt, and reduce harm earlier.

We will also examine the overlap between cybercrime and real-world fraud, challenging the traditional separation between cybersecurity and fraud functions. Attendees will leave with practical approaches for integrating dark web intelligence into risk management, executive decision-making, and cross-functional response, directly supporting the conference theme of turning knowledge into action and insight into impact.

Intelligence 2026 emphasises closing the gap between strategic intent and operational delivery, ensuring that knowledge turns into action and insight results in measurable impact. This gap is most evident in organisational approaches to insider threat.

Many organisations report advanced insider threat capabilities. Policies are documented, monitoring tools are in place, awareness programs are delivered, and dashboards are populated with indicators.

However, when behavioural signals surface in volatile or high-pressure situations, intelligence often stalls before it leads to decisive action. Escalation paths remain unclear, ownership is scattered across functions, and behavioural cues are interpreted inconsistently. The presence of controls is mistaken for preparedness.

Building on cross-sector capability assessments and governance advisory work, this paper contends that insider threat maturity is hard to judge because it is often assessed by structural artefacts rather than by the reliability of integrated decision pathways under stress. Detection without coordinated integration does not allow leaders to act swiftly, confidently, or with precision.

Aligned with the sub-theme of Impact and Integration, this paper redefines insider threat capability as a challenge in intelligence delivery.

It suggests practical principles for assessing real-world readiness, integrating behavioural insights into governance frameworks, and ensuring that intelligence consistently informs proportionate and timely organisational decisions.

In a risk environment defined by volatility and interconnectivity, intelligence must do more than inform. It must be designed to move.

Critical infrastructure sits on the frontline of national security risk, yet most assets are operated by non-government organisations whose security decisions are shaped by commercial incentives and enterprise risk frameworks, rather than intelligence reporting. This has created a persistent gap between the real threats understood by intelligence agencies and the security actions taken by industry. Drawing on practitioner experience as a former intelligence officer now working in the critical infrastructure sector, this paper examines why classified intelligence often struggles to translate into effective security outcomes.

The environments in which intelligence is collected, analysed and produced are fundamentally different from those in which operational security decisions are made. Intelligence agencies necessarily communicate threat in abstract terms to protect sources and manage classification, but this can leave intelligence products feeling distant from the day-to-day realities of running complex infrastructure systems.

Intelligence agencies provide threat advice rather than enforceable direction, meaning organisations must interpret and prioritise that advice within their own commercial and regulatory frameworks, where resources are already highly contested. For senior decision-makers driven by commercial incentives and informed by quantifiable evidence, threat reporting can struggle to resonate.

These challenges are compounded by practical barriers to using classified intelligence in corporate environments. Handling requirements, clearance limitations and uneven security maturity make it difficult to translate sensitive reporting into advice that can be broadly understood and acted upon.

This paper argues that improving the impact of intelligence requires more than just information sharing. It requires a deliberate effort to bridge the intelligence–industry divide by translating threat assessments into practical terms that align with how organisations understand and manage risk. Until this gap is addressed, critical infrastructure will remain exposed to high-consequence security risks with significant economic, societal and national security implications.

Effective regulation of market competition is essential to supply chain security and economic welfare in Australia. Social sentiment is increasingly driven by economic conditions linking agile government responses to social cohesion. While market competition has been historically difficult to detect, the emergence of artificial intelligence (AI) enhanced statistical techniques offers a new opportunity in market surveillance tradecraft. Traditional statistical tests use variance, skewness, and bid gaps to detect bid rigging. AI models can dynamically adjust thresholds for these tests and integrate with partner systems to make more accurate assessments. Factors can be layered within AI tools enabling a combination of low bidder variance, history of co-biding, and consistency of subcontracting to factor into an assessment. AI can further be trained using data from a normal competitive market and anti-competitive markets. From this information it can use k-means or DBSCAN machine learning algorithms to identify clusters invisible to traditional statistical methods. This paper will explore the potential of new AI market surveillance techniques and their effectiveness for detecting concealed anti-competitive behaviour. It will also consider how Commonwealth regulators can partner to integrate systems with departments and agencies, state governments, and industry to gain access to data and improve the detection of anti-competitive conduct.

This paper argues that meaningful convergence is occurring between risk management and the intelligence cycle, yielding an emergent practice termed risk intelligence. Drawing on security convergence theory, enterprise risk management frameworks, and intelligence studies literature, the paper traces how organisational, process, product, and information-level convergence have progressively dissolved the boundaries between these two disciplines. The paper maps the structural parallels between the risk management process and the intelligence cycle, culminating in the concept of Risk Management Based Intelligence (RMBI). It then situates Generative Artificial Intelligence (GenAI) as both a catalyst and a complicating variable in this convergence: while GenAI dramatically accelerates data synthesis, translation, and predictive analysis, it simultaneously introduces new uncertainties around source transparency, hallucination, adversarial disinformation, and the erosion of human analytical judgement. Six evolutionary trends shaping the intelligence community are identified, from the big data revolution to the prospect of human-machine teaming. The paper concludes that the promise of risk intelligence as a unified business process is real but will remain unrealised without sustained investment in analyst professionalisation, governance frameworks, and the principled integration of GenAI tools that keep humans meaningfully in the loop.