Cyber Voices

Responding to a Cyber Crisis You Don’t Control with Darren Hopkins

In this episode of Cyber Voices, recorded live at BrisSEC 2026, host David Savva-Willett speaks with Darren Hopkins, Partner at McGrathNicol and a Brisbane-based cybersecurity professional with more than 30 years’ experience across law enforcement, digital forensics, incident response and cyber crisis management. Darren shares insights from his BrisSEC talk, “When You’re Already Losing: Responding to a Cyber Crisis You Don’t Control,” exploring the messy reality of cyber incidents where the playbook does not match the crisis. From third-party suppliers and SaaS dependencies to ransomware negotiations, regulators, media pressure, board expectations and limited information, Darren explains why effective incident response requires more than a neatly documented plan. David and Darren discuss why cyber crisis simulations matter, how organisations can build decision-making muscle memory, the importance of update cadence, the risks of over-communication, and why many incidents remain preventable through basic cyber hygiene, prioritisation and executive support. This episode is essential listening for CISOs, security leaders, board members, risk teams, communications professionals and anyone involved in preparing for or responding to a cyber incident. In this episode, we cover: * How to respond when you do not control the cyber crisis * Why incident response plans still matter, even when reality gets chaotic * The role of executives, legal, communications, HR and technical teams during a breach * Why third-party and SaaS risk changes crisis response * How cyber simulations can prepare boards and leadership teams * The importance of clear communication and update cadence * Why are many cyber incidents still preventable * What cyber leaders should start doing differently today

Inside the Mind of an Attacker — Atticus D'mello on Bypassing Social Media's Security Controls

Recorded live on the floor at BrisSEC 2026 in Brisbane, David Savva-Willett sits down with Atticus D'mello, higher degree research student, vulnerability researcher, and emerging cybersecurity specialist with Safety Net Cyber, to unpack his BrisSEC talk Inside the Mind of an Attacker. Atticus walks us through how he and his team approached one of the most under-discussed problems in consumer cybersecurity: how attackers bypass account creation limits on the world's biggest social media platforms to spin up anonymous accounts at scale. Working with nothing more than a laptop and a typical home internet connection, they mapped the controls, found the gaps, and responsibly disclosed the vulnerabilities, many of which have now been fully patched. The conversation goes beyond the technical, exploring why burner accounts are the gateway to online bullying, mass phishing, artificial engagement, and large-scale scams, and the very real human toll that follows. Atticus also shares his work helping victims regain access to compromised Instagram and Facebook accounts, the rise of fake "Meta verification" phishing emails, why TikTok's security-by-default model is worth paying attention to, and what every one of us can do to make social media a safer space. If you've ever wondered how those random accounts in your DMs come from nowhere — this one's for you.

Quantum Safe Queensland: A Practical Roadmap with Prof. Craig Costello

Q-Day is coming — and the encryption protecting your most sensitive data may already be on borrowed time. In this episode of Cyber Voices, host David Savva-Willett sits down at AISA's BrisSec 2026 with Professor Craig Costello, cryptographer at the Queensland University of Technology and one of the global researchers shaping post-quantum cryptography (PQC) standards. Craig demystifies what post-quantum cryptography actually is, why "harvest now, decrypt later" attacks mean the threat is already here, and what recent breakthroughs from Google AI, UC Berkeley and Caltech mean for the timeline. He unpacks Google's bold 2029 Q-Day prediction, explains why PQC runs on the classical hardware you already own, and walks through a pragmatic transition roadmap aligned to the Australian Signals Directorate's guidance — from naming a transition lead and running an inventory scan, to prioritising key exchange over digital signatures, and managing vendor migrations. Whether you're a CISO, security architect, or just trying to understand what quantum computing really means for your organisation, this is a clear-eyed, panic-free conversation about preparing for the biggest cryptographic shift in 50 years. Topics covered: • What post-quantum cryptography is (and isn't) • Harvest now, decrypt later attacks explained • Why Google says Q-Day arrives by 2029 • Recent algorithmic breakthroughs lowering qubit requirements • A practical PQC transition plan: 90 days and beyond • ASD guidance and the road to 2030 • Crypto agility as a long-term security discipline Cyber Voices is the official podcast of the Australian Information Security Association (AISA). Planning for Post-Quantum Cryptography (the page Craig referenced directly) The ASD's practical framework covering inventory scans, transition timelines, and milestones — including the recommended deadline of end of 2030 to cease use of traditional asymmetric cryptography. 🔗 https://www.cyber.gov.au/business-government/secure-design/planning-for-post-quantum-cryptography [https://www.cyber.gov.au/business-government/secure-design/planning-for-post-quantum-cryptography] Information Security Manual (ISM) — landing page The full ISM, intended for CISOs, CIOs, and cyber security professionals. 🔗 https://www.cyber.gov.au/business-government/asds-cyber-security-frameworks/ism [https://www.cyber.gov.au/business-government/asds-cyber-security-frameworks/ism] ISM — Guidelines for Cryptography The chapter that contains the specific PQC controls Craig mentioned, including ISM-2073 (PQC transition plan requirement) and the list of ASD-approved post-quantum algorithms. 🔗 https://www.cyber.gov.au/business-government/asds-cyber-security-frameworks/ism/cyber-security-guidelines/guidelines-for-cryptography [https://www.cyber.gov.au/business-government/asds-cyber-security-frameworks/ism/cyber-security-guidelines/guidelines-for-cryptography]  Professor Craig Costello — QUT profile For listeners who want to take Craig up on his offer to engage directly with industry partners. 🔗 https://www.qut.edu.au/about/our-people/academic-profiles/craig.costello [https://www.qut.edu.au/about/our-people/academic-profiles/craig.costello]

Inside the Dark Web Economy: Anastasia Tikhonova on 2026's Top Cyber Threats

The Problem of Trust: Identity Fraud, Deepfakes & APAC Threat Trends with Anastasia Tikhonova What happens when cybercriminals stop attacking your CEO and start targeting your developers instead? In this episode of Cyber Voices, host David Savva-Willett sits down with Anastasia Tikhonova, Global Threat Research Lead at Group-IB, joining live from Phuket, Thailand, to unpack the threat trends defining 2026 — and why Australia remains squarely in the crosshairs. Anastasia shares how her team connects threat intelligence dots across APAC, EMEA, and Latin America, and explains why she calls 2026 the year of "the problem of trust" — where attackers no longer need just your email and password. They want your voice, your face, your LinkedIn, and your professional connections to impersonate you convincingly enough to compromise the organisations you work with. In this episode, you'll hear about: * The rise of identity fraud, deepfakes, and AI-powered social engineering * Why Scattered Spider, Lazarus Group and others are shifting from mass campaigns to highly targeted persona attacks * The Axios NPM supply chain compromise (80 million weekly downloads) and what it means for every organisation * How dark web marketplaces, arbitration "courts," and Telegram-based criminal communities operate today * Why Australia is the #2 ransomware target in APAC — and the lessons from the April 2025 super fund attacks * The role of hacktivism, geopolitical conflict, and national state actors in Australian threat activity * Practical advice on managing your digital footprint when you, your family, or your executives have a public profile Whether you're a CISO, security analyst, developer, or simply curious about how cybercrime is evolving, this conversation delivers global perspective with sharp Australian relevance. Cyber Voices is the official podcast of the Australian Information Security Association (AISA) — bringing you the voices shaping cybersecurity in Australia and beyond. 🎧 Subscribe wherever you get your podcasts and follow AISA for more.

Year One in the Seat: Tara Dharnikota on What It Really Takes to Be a CISO

What does it really take to step into the CISO seat, and thrive? In this episode of Cyber Voices, the official podcast of AISA and the home of Australia's cybersecurity community, host David Savva-Willett sits down with Tara Dharnikota, Chief Information Security Officer at Victoria University. With a career spanning Telstra, PEXA, and now one of Australia's leading universities, Tara brings a rare blend of offensive security expertise, OSINT, and executive leadership. In this candid conversation, she reflects on her first year as CISO, what surprised her, what she'd do differently, and what the role of the future really looks like. In this episode, you'll hear: * Why the CISO role is fundamentally about translation, not just technology * How to communicate security risk to boards and executives in a language they actually understand * The trap of trying to prove yourself too fast — and why influence matters more than expertise * What "building security with people" rather than for them really means in practice * The convergence of cyber and physical security in complex environments like universities * Tara's vision for the CISO of 2030 — and what aspiring CISOs should be doing right now * The role that communities like AISA play in shaping future security leaders Whether you're an aspiring CISO, a seasoned security leader, or an executive trying to better understand your security function — this episode is essential listening. 🎟️ Early bird registrations for the Australian Cyber Conference 2026 are open now — 14–16 October. AISA members grab a full 3-day Gold Pass for just $899. Head to cyberconference.com.au [https://cyberconference.com.au] before 30 June. Subscribe, leave a 5-star review, and share this episode with someone on their path to the CISO seat.